Documentation is unclear. UMA Authorization process #9704

VerdonTrigance · 2022-01-21T09:41:29Z

VerdonTrigance
Jan 21, 2022

Question is about this section https://www.keycloak.org/docs/latest/authorization_services/#_service_uma_authorization_process.
When user visit my application's webAPI endpoint he doesn't know anything about 'resource server' and everything else. He just visit /api/survey/123 for example. But in documentation it seems like user requesting well know resource address:

Client requests a protected resource without sending an RPT
curl -X GET
http://${host}:${port}/my-resource-server/resource/1bfdfe78-a4e1-4c2d-b142-fc92b75b986f

This brings me to the next questions:

It means I have to make request from my webAPI (/api/survey/123) from the user behave to Keycloak 'auth/realms/{realm}/authz/protection/resource_set' endpoint in advance and find resource with URI '/api/survey/123' and make such request to Keycloak like in documentation?

http://${host}:${port}/my-resource-server/resource/1bfdfe78-a4e1-4c2d-b142-fc92b75b986f

And stepping back - what resource server actually is? Is it Keycloak's client related server created when I check 'Allow Authorization' in Keycloak or is it my application like /api/survey? If it's my app, then I should generate all these stuff including tokens by myself:

The resource server sends a response back to the client with a permission ticket and a as_uri parameter with the location of a Keycloak server to where the ticket should be sent in order to obtain an RPT.

Resource server responds with a permission ticket
HTTP/1.1 401 Unauthorized
WWW-Authenticate: UMA realm="${realm}",
as_uri="https://${host}:${port}/auth/realms/${realm}",
ticket="016f84e8-f9b9-11e0-bd6f-0021cc6004de"

It's quite complicated without looking at whole process from above. This obscurity adds challenge to write .net client.

pckhoi · 2022-08-16T01:24:06Z

pckhoi
Aug 16, 2022

General tip regarding the Keycloak UMA flow: you still need to cross-reference the UMA spec in these 2 documents to understand:

Suppose your app has a typical client/server architecture. When the user uses the client, the client send a web request to /api/survey/123 of the server. The server at this point should have registered the resource at /api/survey/123 at some points and stored the resource's _id somewhere. It can then use this _id to create a permission ticket, which you then give back to the client in the WWW-Authenticate header in the 401 Unauthorized response.
"Resource server" is an UMA and OAuth2 jargon. It means a server that keep resources. In your case, it would be your api server that host the path /api/survey. Also:

In Keycloak, any confidential client application can act as a resource server. This client’s resources and their respective scopes are 
protected and governed by a set of authorization policies.

For practica 8000 l purpose, a confidential client can be a resource server (but doesn't have to be). You still have to understand this concept well.

3 replies

VerdonTrigance Aug 16, 2022
Author

And here is a problem. 1) I use Keycloak for this purpose! I mean when register my Uri in keycloak resource server I don’t store any ids in my app, I assume I can easy get it from Keycloak. And this means I can’t create ticket request as you told. 2) Again in this case I assume that Keycloak is a resource server I use to store uri/id pairs. If it can act as resource server it should be usable, but what I see in your description is that it can’t be.

pckhoi Aug 16, 2022

Since _id is generated by Keycloak, there are 2 ways to get it:

You can either store it when you register the resource with Keycloak the first time, maybe in your SQL database, and then get it from there.
Or you can query Keycloak for the resource using the name:

http://${host}:${port}/realms/${realm_name}/authz/protection/resource_set?name=Alice Resource

The second way will probably have worse latency so I wouldn't use it.

If you're talking about resource server as defined in OAuth2 then no, Keycloak isn't a resource server. Your api is the resource server. Keycloak is the authorization server.

VerdonTrigance Aug 16, 2022
Author

Looks like a workaround. Sorry, but I can’t check it right now because I’m out of this project.

Navigation Menu

Repository navigation

Documentation is unclear. UMA Authorization process #9704

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Documentation is unclear. UMA Authorization process #9704

Uh oh!

Uh oh!

VerdonTrigance Jan 21, 2022

Replies: 1 comment · 3 replies

Uh oh!

pckhoi Aug 16, 2022

Uh oh!

VerdonTrigance Aug 16, 2022 Author

Uh oh!

pckhoi Aug 16, 2022

Uh oh!

VerdonTrigance Aug 16, 2022 Author

VerdonTrigance
Jan 21, 2022

Replies: 1 comment 3 replies

pckhoi
Aug 16, 2022

VerdonTrigance Aug 16, 2022
Author

VerdonTrigance Aug 16, 2022
Author