0

I am using a Keycloak 9 alongside multiple Jhipster 6.7.1 instances.

  1. Orchestration microservice is using "confidential" access type in Keycloak and successfully generates and authenticates the token.
  2. Roles setup within the orchestration client, had to be mapped, using "User Client Role" with "roles" as the Token Claim Name, in order for @PreAuthorize to work. If I try to pass on the Groups, for some reason Jhipster disregards the Roles and only returns the Groups value which results in @PreAuthorize failure.
  3. Other microservices are using "brearer" access type in Keycloak. Any Orchestration Roles set in order to authorise the microservices is totally being disregarded, hence authorisation check between orchestration and microservices fails with an access denied.
  4. Communication between Orchestration and other microservices are being handled by @AuthorizedFeignClient

I was wondering what am I doing wrong here, that the Orchestration Client Roles are not being passed on to corresponding microservices and also is there a way to map groups and roles in a nested manner so it complies with the existing Jhipster code without changing.

2
  • Are your role names prefixed by ROLE_ ? I think it's the default for spring security. Mar 4, 2020 at 22:41
  • @GaëlMarziou yes they are, tried both ways with and without without any luck. So essentially I faced two issues, one with custom mapping of groups and roles, which didnt nest and if groups was used, roles was disregarded. Only roles as a custom token worked. Keycloak client with bearer option doesnt offer you custom mapping anyway, so ROLE_ was added.
    – sam
    Mar 4, 2020 at 23:12

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.