Cannot get roles scope in access token in password grant flow #19114

franck102 · 2023-03-19T12:01:00Z

franck102
Mar 19, 2023

Hi all,

Despite reading through the docs 20 times I must be missing something about clients, scopes and roles.
I have a realm role assigned to a user; and I am trying to have that assignment included in the access token obtained through a pass word grant flow. I am using a CLI client (curl) making this request:

curl --fail --show-error -s "$KEYCLOAK_URL" \
   -d "username=$USERNAME" \
   -d "password=$PASSWORD" \
   -d 'grant_type=password' \
   -d 'scope=openid roles' \
   -d "client_id=admin-cli"

And the returned token has "scope":"openid profile email". Here is what I checked:

the user has the realm role assigned
The admin-cli client -> client scopes -> admin-cli-dedicated includes "realm roles" which is the built-in User Realm Role mapper type
The "User Real Role" mapper "Mapper Details" page has "Add to Access Token" checked

As a side note, if I add a bogus scope name in my request (e.g. "scope=openid foobar") then the request fails with a 400.
So my scope request parameter is not entirely ignored, but Keycloak only includes openid email profile in the issued token, no matter what I ask for.

What am I missing???
Thanks!

Answered by franck102

Mar 20, 2023

So that "Assign role to scope" is the key to make this work, it can be done in one of two places (new UI):

Client scopes -> roles -> Scope -> Assign Role
Clients -> admin-cli -> Client scopes -> admin-cli-dedicated -> Scope

I am pretty new to OIDC, but if I may I find the terminology pretty confusing. In both cases the description mentions "Create a role to get started" - I am looking to select or enable an existing role.
And when I read "Assign a role" to something my understanding is that I will make that something (the client scope) "have" the role - not that I am setting it up to include a user role should it exist.
It is also unexpected to find a "Scope" tab under
[Clients] -> [Clien…

View full answer

DAHAG-ArisNourbakhsh · 2023-03-20T09:34:33Z

DAHAG-ArisNourbakhsh
Mar 20, 2023

If you go to the admin-cli client-> Client Scopes -> Evaluate, Select the user and Evaluate the Effective Protocol Mappers is the realm roles mapper listed ? Conversely if you switch to Generated Access Token are the realm roles included under the realm_access claim?
Where in the JWT are you looking for the roles ?
Post your realm_roles mapper settings

0 replies

franck102 · 2023-03-20T15:12:09Z

franck102
Mar 20, 2023
Author

If I go to admin-cli client -> client scopes -> evaluate:

"roles" is not available as a "scope parameter" if I set it as a "Default" scope for the client; it is available if I set it as optional - as one would expect
In "effective protocol mappers" two "realm roles" lines are available: one has "roles" as the "parent client scope", one has its parent undefined (priority 40 for both).
realm_access does not appear in the sample generated access token (that is where I was looking for the roles in the token). Same issue whether "roles" is optional and explicitly specified as a scope parameter, or configured as "Default"

The realm role is named "easypass-admin", composite = False, description is empty. It has no attributes, the user is listed in the role, and "Permissions enabled" is unchecked.

Since my previous post I found that if I check "Full Scope Allowed" in Clients -> admin-cli -> client scopes -> admin-cli-dedicated -> scope then the roles are included.

Here is the full configuration of the client:
admin-cli.txt

0 replies

franck102 · 2023-03-20T15:23:38Z

franck102
Mar 20, 2023
Author

On that same "Evaluate" page, everything works as expected if "Full Scope Allowed" is selected.
I guess I am seeing two "realm roles" protocol mappers simply because I added the roles mapper explicitly under admin-cli-dedicated scope. I can remove that explicit mapper and use the predefined "roles" client scope and the token looks fine.

So the question is, is it normal / expected to have to select "Full Scope Allowed"? This is not what I understood from the documentation:

"By default, the effective roles of scopes are every declared role in the realm. To change this default behavior, toggle Full Scope Allowed to OFF and declare the specific roles you want in each client."

... although I don't see where I would "declare the specific roles you want in each client"?

Franck

3 replies

DAHAG-ArisNourbakhsh Mar 20, 2023

Depends on which AdminUI you are using. In the legacy UI that is right below the "Full Scope Allowed" Toggle where you can "allowList" aka "Assigned Roles" the roles the mapper can include.

In the new Admin UI it's also right below it. Just press the "Assign role" to add any realm or client role to the "allowed roles"

franck102 Mar 20, 2023
Author

I am using the new UI I believe, and there is nothing under "Full Scope Allowed" (Chrome on MacOS):

[Edit] Oops, you need to uncheck "Full Scope Allowed" and some UI appears. However it says
You haven't created any roles for this client. Create a role to get started.

... so I had been assuming that this was used to configure "client roles" (if such a thing exists), not realm roles. The "Create a role" is also pretty confusing, even though the button below it says "Assign role".

Now, going through the UI I find a similar option in the shared client scope, I will test all this and report back.

Thanks!

DAHAG-ArisNourbakhsh Mar 20, 2023

There is only the option to do granular role selection when Full Scope Allowed is off.
Edit: Hope it works now

franck102 · 2023-03-20T16:38:32Z

franck102
Mar 20, 2023
Author

So that "Assign role to scope" is the key to make this work, it can be done in one of two places (new UI):

Client scopes -> roles -> Scope -> Assign Role
Clients -> admin-cli -> Client scopes -> admin-cli-dedicated -> Scope

I am pretty new to OIDC, but if I may I find the terminology pretty confusing. In both cases the description mentions "Create a role to get started" - I am looking to select or enable an existing role.
And when I read "Assign a role" to something my understanding is that I will make that something (the client scope) "have" the role - not that I am setting it up to include a user role should it exist.
It is also unexpected to find a "Scope" tab under
[Clients] -> [Client details] -> Dedicated scopes -> admin-cli given that admin-cli-dedicated is a scope itself. The same applies to client scopes... there are just too many "scopes" flying around IMHO :)

Thanks for the help!

0 replies

Navigation Menu

Repository navigation

Cannot get roles scope in access token in password grant flow #19114

Uh oh!

{{title}}

Uh oh!

Replies: 4 comments 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Cannot get roles scope in access token in password grant flow #19114

Uh oh!

franck102 Mar 19, 2023

Replies: 4 comments · 3 replies

Uh oh!

DAHAG-ArisNourbakhsh Mar 20, 2023

Uh oh!

franck102 Mar 20, 2023 Author

Uh oh!

franck102 Mar 20, 2023 Author

Uh oh!

DAHAG-ArisNourbakhsh Mar 20, 2023

Uh oh!

Uh oh!

franck102 Mar 20, 2023 Author

Uh oh!

Uh oh!

DAHAG-ArisNourbakhsh Mar 20, 2023

Uh oh!

franck102 Mar 20, 2023 Author

franck102
Mar 19, 2023

Replies: 4 comments 3 replies

DAHAG-ArisNourbakhsh
Mar 20, 2023

franck102
Mar 20, 2023
Author

franck102
Mar 20, 2023
Author

franck102 Mar 20, 2023
Author

franck102
Mar 20, 2023
Author