Repository navigation
Bearer token delivers 403 for working user #9275
Answered
by
bs-matil
Giovannisimo
asked this question in
Q&A
|
Dear community, I'm really stuck with a problem here. I implemented a confidential keycloak client and it works fine in browser. But not with a bearer token. PREREQUISITES:
oRouter.get('/api/', keycloak.protect('User'), async (oReq, oRes, next)=>{
oRes.send("Hi API User!");
const sToken = oReq.kauth.grant["access_token"].token
oBaseLogger.info('API Usage!',
{
access_token: keycloak.decodeAccessToken(sToken),
tokenVerified: await keycloak.verifyToken(sToken),
url: "/api/"
});
});
Keycloak.prototype.redirectToLogin = (oReq) => {
var apiReqMatcher = new RegExp("\/api\/");
var sBearer = oReq.headers.authorization ?? "no bearer token";
oBaseLogger.info('User called protected url without login.',
{
bearer_token: keycloak.decodeAccessToken(sBearer.substring(7, sBearer.length)) ?? "no bearer token",
access_token: keycloak.decodeAccessToken(oReq.kauth?.grant?.access_token?.token) ?? "no token provided",
url: oReq.url,
redirect: !apiReqMatcher.test(oReq.originalUrl || oReq.url)
});
return !apiReqMatcher.test(oReq.originalUrl || oReq.url);
}
PROBLEM: LOGS:
{
exp: 1640074508,
iat: 1640074208,
auth_time: 1640074208,
jti: '9dd07eb9-6911-4536-b9ec-e76f3582ba52',
iss: 'http://localhost/auth/realms/Backend',
aud: [ 'backend', 'account' ],
sub: '093ed27c-94f1-4cb9-8d3b-a36ba5b9f4fd',
typ: 'Bearer',
azp: 'backend',
session_state: 'cb1a6afe-6fc9-48a2-a0e7-f56ae5a90efe',
acr: '1',
'allowed-origins': [
'https://locahost:8080/*',
'http://localhost:8080',
'localhost:8080',
'*'
],
realm_access: {
roles: [
'User',
'default-roles-backend',
'offline_access',
'uma_authorization'
]
},
resource_access: {
backend: { roles: [ 'User' ] },
account: {
roles: [ 'manage-account', 'manage-account-links', 'view-profile' ]
}
},
scope: 'openid profile email',
sid: 'cb1a6afe-6fc9-48a2-a0e7-f56ae5a90efe',
email_verified: true,
roles: [
'User',
'default-roles-backend',
'offline_access',
'uma_authorization'
],
name: 'Standard_User_01_Surname Standard_User_01_LastName',
preferred_username: 'standard_user_01',
given_name: 'Standard_User_01_Surname',
family_name: 'Standard_User_01_LastName'
}
{
exp: 1640073736,
iat: 1640073436,
jti: '997cd724-efde-499e-9746-124edaf20924',
iss: 'http://localhost:80/auth/realms/Backend',
aud: [ 'backend', 'account' ],
sub: '093ed27c-94f1-4cb9-8d3b-a36ba5b9f4fd',
typ: 'Bearer',
azp: 'backend',
session_state: '9398bc3a-2bac-4cca-9126-422adef71aa5',
acr: '1',
'allowed-origins': [
'https://locahost:8080/*',
'http://localhost:8080',
'localhost:8080',
'*'
],
realm_access: {
roles: [
'User',
'default-roles-backend',
'offline_access',
'uma_authorization'
]
},
resource_access: {
backend: { roles: [ 'User' ] },
account: {
roles: [ 'manage-account', 'manage-account-links', 'view-profile' ]
}
},
scope: 'openid profile email',
sid: '9398bc3a-2bac-4cca-9126-422adef71aa5',
email_verified: true,
roles: [
'User',
'default-roles-backend',
'offline_access',
'uma_authorization'
],
name: 'Standard_User_01_Surname Standard_User_01_LastName',
preferred_username: 'standard_user_01',
given_name: 'Standard_User_01_Surname',
family_name: 'Standard_User_01_LastName'
}I have really no clue, why the one token works fine (in browser) and the other one doesn't. I'd be so glad if someone can come up with any idea. Thanks!! Regards from Germany |
Answered by
bs-matil
Dec 21, 2021
Replies: 1 comment 1 reply
|
The issuer in the second token is wrong: |
1 reply
|
Indeed, the port had to be removed. So many thanks! |
Answer selected by
Giovannisimo
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The issuer in the second token is wrong:
iss: 'http://localhost:80/auth/realms/Backend',