Obtaining Permissions by pushing claims from Backend by using AccessToken from frontend (reactSPA) #35310

sachingaikwad123 · 2024-11-26T09:46:17Z

sachingaikwad123
Nov 26, 2024

Question: I would like "Resource Server" to provide some extra information regarding "resource instance" being "acted on" so that keycloak's policy can use this attribute information in its decision. For example, resource server may want to send "department_id" information to keycloak. Keycloak policy may want to check and make sure user's department_id is resource_instance's department_id, then "allow" or deny.

Question: How to do such dynamic resource (instances's) attribute ABAC using keycloak javascript policy?

I see that we can 'Contextual Information' in Keycloak "Evaluate"

Client --> Authorization -> Evaluate --> "Contextual Information" --> Contextual Attributes:

What is the use of this? Can I pass any custom attribute using this to my javascript policy?
Can any help with example of how to do this from our own code (Evaluation API call from python)? How to provide context information in this API payload?

sachingaikwad123 · 2024-11-26T18:53:21Z

sachingaikwad123
Nov 26, 2024
Author

Is it possible to pass 'contextual custom attributes' like below when checking permissions for an resource? Will this attribute be available in custom javascript policy via 'EvaluationContext -> Attributes'?

I think, this will greatly enhance ABAC support.

    auth_url = "https://localhost:8443/realms/smorion/protocol/openid-connect/token"
    payload = {
        "grant_type": "urn:ietf:params:oauth:grant-type:uma-ticket",
        "permission": ",".join(str(permission) for permission in permissions),
        "response_mode": "decision",
        "audience": BACKEND_CLIENT_ID,
        "context": {
            "custom": {
                "organization_id": "12345"
            },
        }
    }
    headers = {
        "Authorization": "Bearer " + token['access_token'],
        "Content-Type": "application/x-www-form-urlencoded",
    }

1 reply

sachingaikwad123 Dec 4, 2024
Author

TLDR Question: Can backend client use "Access Token" obtained by "frontend" client and use it to 'authorization check' (Keycloak Policies) and pass "claim_token" in it? For me it returns error: "Public clients are not allowed to send claims"

It is possible to send 'custom attributes' to Keycloak which are then available in JS Policy for evaluation via 'Context Attributes'. Here is what I did to test this:

Python code:

  keycloak_openid = KeycloakOpenID(server_url=SERVER_URL,
                                    realm_name=REALM_NAME,
                                    client_id=BACKEND_CLIENT_ID,
                                    client_secret_key=CLIENT_SECRET)
   token = keycloak_openid.token(username=username,
                                 password=password)
   r = Resource(resource=resource)
   s = Scope(scope=scope)
   permission = r(s)
   print(f"Resource and Scope: {permission}")
   permissions = [permission]
   auth_url = "https://localhost:8443/realms/test-realm/protocol/openid-connect/token"
   claim_token_data = {
       "organization_id": ["123456", "895743"],
       "user_organization_id": ["98761", "93658"],
   }
   claim_token = get_additional_claim_token(claim_token_data)
   payload = {
       "grant_type": "urn:ietf:params:oauth:grant-type:uma-ticket",
       "permission": ",".join(str(permission) for permission in permissions),
       "response_mode": "decision",
       "audience": BACKEND_CLIENT_ID,
       "claim_token_format": "urn:ietf:params:oauth:token-type:jwt",
       "claim_token": claim_token,
   }
   headers = {
       "Authorization": "Bearer " + token['access_token'],
       "Content-Type": "application/x-www-form-urlencoded",
   }
   response = _send_request("post",
                            url=auth_url,
                            data=payload,
                            headers=headers)

This works well and I was able to print 'Context Attributes' in my custom JS Policy from Keycloak.

However, in this test program, there is no "frontend client" involved. I then did testing with my actual setup where 'react SPA' (frontend) client is involved.

Setup:

React SPA does login for 'user' with Keycloak and obtains IDToken and AccessToken. (OAuth2 Authorization Code Grant + PKCE)
React SPA calls REST API (in Django) with 'AccessToken'
Django then checks 'permission' for this user by: sending 'POST' request to Keycloak ("grant_type": "urn:ietf:params:oauth:grant-type:uma-ticket",) and use same 'Access Token' in authorization header.

Step-3: Works fine and Keycloak is able to answer if I don't pass any 'claim_token'. But, if I pass any 'claim_token' then Keycloak POST call fails and keycloak logs show this error:

keycloak-keycloak-1 | 2024-12-03 06:13:52,347 WARN [org.keycloak.events] (executor-thread-95) type="PERMISSION_TOKEN_ERROR", realmId="5b4b2400-c3cc-9534-79f6-dce5ba6905a4", realmName="test-realm", clientId="frontend-client", userId="null", ipAddress="172.18.0.1", error="invalid_request", reason="Public clients are not allowed to send claims", auth_method="oauth_credentials", audience="backend-client", grant_type="urn:ietf:params:oauth:grant-type:uma-ticket", permission="resource1#update"

Error reason: "Public clients are not allowed to send claims"

This error makes sense. Because, any public client should not be able to push any claims to our Keycloak server. But, in this case, we know that it is not "frontend" (public client) but actually a "backend" client (django) which is trying to do this. But, keycloak is determining client's status from some fields of "Access Token" I think, right?

Questions:

Is it possible to get this setup working where "backend" can still send "claims" and do permission check? I do want "user token" to be passed to Keycloak because policies will need to check user-roles, etc. in the policy based on this token.
Do I need to pass "client_secret" in 'POST' call along with "Access Token" to prove that this is backend client? I tried this, but it failed.
Do I need to do 'token-exchange' and get 'token' specifically for 'backend' client?

Some notes about "AccessToken"

aud: backend-client
azp: frontend-client
typ: "Bearer"

nvp152 · 2025-09-02T06:26:44Z

nvp152
Sep 2, 2025

Did you figure this out ? It is confusing to me how other things like the creation of authz resources and validation of access to these new resource work just fine with the token minted by the front end client and used by the backend confidential client, but this particular use case does not........

0 replies

Navigation Menu

Repository navigation

Obtaining Permissions by pushing claims from Backend by using AccessToken from frontend (reactSPA) #35310

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Obtaining Permissions by pushing claims from Backend by using AccessToken from frontend (reactSPA) #35310

Uh oh!

sachingaikwad123 Nov 26, 2024

Replies: 2 comments · 1 reply

Uh oh!

sachingaikwad123 Nov 26, 2024 Author

Uh oh!

sachingaikwad123 Dec 4, 2024 Author

Uh oh!

Uh oh!

nvp152 Sep 2, 2025

sachingaikwad123
Nov 26, 2024

Replies: 2 comments 1 reply

sachingaikwad123
Nov 26, 2024
Author

sachingaikwad123 Dec 4, 2024
Author

nvp152
Sep 2, 2025