Use Client scope with Service Accounts and Standard Flow #13486

ppaulis · 2022-08-02T15:06:39Z

ppaulis
Aug 2, 2022

I have a RESTful API that is consumed by a browser frontend and multiple machine-to-machine clients. So I'm issuing tokens with Keycloak 18 through Standard Flow (Authorization code) and Service Account Flow (Client credentials).

The operations on the API's resources are protected by scopes like read:resourceA, update:resourceA, read:resourceB, etc.

When I assign a Realm Role to a Client Scope, and if I map a user to the same Realm Role, the tokens issued through the Authorization Code Flow (browser frontend) contain the scope.

Also, when I create a Machine-to-Machine client and I add the Client Scope directly to the Client, the tokens for the M2M client also contain the scope.

So far so good. But as soon as I try to do both at the same time, I no longer have the scope in tokens issued by the M2M-client.

It seems that adding a Client Scope to a Role makes it impossible to use that scope otherwise.

The obvious, but bad solution would be to create a second set of scopes for this kind of client. Is there any other solution I'm not aware of?

I'm migrating from Auth0.com to Keycloak, and there I can do this, because permissions are assigned to the API. So I'm wondering if I'm missing something here.

Thanks a lot,
Pascal

Answered by ppaulis

Aug 22, 2022

Found the solution. It turns out that I completely missed the concept of Service Account Roles.

For those running into the same trouble:

How to add a new Role to an Authorization code flow client

Create client with Default Flow enabled
Create client role
In Client Scope Settings, add the new client role to the scope
In Client Settings, add the scope(s) to the list of default scopes

Add the new client role to the user

How to add a new M2M client
Create the new client
Create a new client role in the Client settings
In the Client settings, in the tab Service Account Roles, assign the new Client Role
In the Client scope settings, assign the new client role
In Client Settings, add the scope…

View full answer

ppaulis · 2022-08-22T06:35:11Z

ppaulis
Aug 22, 2022
Author

Found the solution. It turns out that I completely missed the concept of Service Account Roles.

For those running into the same trouble:

How to add a new Role to an Authorization code flow client

Create client with Default Flow enabled
Create client role
In Client Scope Settings, add the new client role to the scope
In Client Settings, add the scope(s) to the list of default scopes

Add the new client role to the user

How to add a new M2M client
Create the new client
Create a new client role in the Client settings
In the Client settings, in the tab Service Account Roles, assign the new Client Role
In the Client scope settings, assign the new client role
In Client Settings, add the scope(s) to the list of default scopes

8000

0 replies

Navigation Menu

Repository navigation

Use Client scope with Service Accounts and Standard Flow #13486

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Use Client scope with Service Accounts and Standard Flow #13486

Uh oh!

ppaulis Aug 2, 2022

Replies: 1 comment

Uh oh!

ppaulis Aug 22, 2022 Author

ppaulis
Aug 2, 2022

ppaulis
Aug 22, 2022
Author