Repository navigation
|
Hello, everyone! I'm quite new to Keycloak and I still have some beginner doubts and questions. Specially regarding Keycloak's capabilities and how it works as an Authorizer.
We have one API, that's configured under a client inside our Realm. For better understanding, I will call it Suppose only the user and people at Even with these filled up, I can access User API without authentication. I know the authentication works because I can get my tokens, do a browser login and validate my token via my API's backend. My goal would be to block any access before the backend is reached at that route, like when we try to authenticate with an invalid token:
Bonus: Where the Thank you in advance! |
Replies: 1 comment 3 replies
|
Hello, you should check the keycloak quistarters repo. Example: https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-spring-security There they show you exactly how to protect a resource (URL) based on couple of different criteria - either policy, owner attribute or role. I also recently worked on a POC of this and I have created a terraform script that prepared keycloak, so if you want you can check my repo: https://github.com/sashokbg/keycloak-authorization |
|
Thanks for point out this example! Checking it I was able to follow that file and build something similar. However, I can't find the mentioned file Cheers! |
|
JS policies are now (since some recent version) deployed as a standalone JAR. Check the https://github.com/keycloak/keycloak-quickstarts/tree/latest/authz-js-policies Basicaly you build the "authz-js-policies" and copy it to the keycloak install dir: keycloak/providers/js-policies.jar Or if you follow my repo it is mounted using docker volume |
|
Hi! Sorry for the late reply. I'm still trying to figure out how to use it in our scenario, but so far we decided to validate the paths accessed via our API, based on what the Thanks for the help! |
Hello, you should check the keycloak quistarters repo.
Example: https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-spring-security
There they show you exactly how to protect a resource (URL) based on couple of different criteria - either policy, owner attribute or role.
I also recently worked on a POC of this and I have created a terraform script that prepared keycloak, so if you want you can check my repo: https://github.com/sashokbg/keycloak-authorization