KeyCloak admin menu access issue

[rboatwright]

Hello,

I am stuck trying to login to my docker deployed stig-manager instance.

docker run --name stig-manager -d -p 54000:54000 -e STIGMAN_CLIENT_KEYCLOAK_CLIENTID=stig-manager -e STIGMAN_OIDC_PROVIDER=http://cloak.privoro.io:8080/auth/realms/stigman nuwcdivnpt/stig-manager

I am able to authenticate, but I am not able to get the admin menu. I have added the scopes and roles as defined in the docs. For some reason, I keep getting defaulted to user only access.

I am sure this is just something minor I am missing, but I cannot seem to figure out where the config is not correct.

[cd-rite]

Hi @rboatwright
Are you able to get the create_collection privilege, or is the problem just with "admin" access? Do you see the option to create a Collection from the NavTree menu? The two privileges are configured the same, they just have different names (unless you have some other rules configured to determine what users get what role). Have you had admin access and something changed, or are you just setting up stigman for the first time?

Can you provide a copy of the access token you get from Keycloak? You can find it if you hover over your user name in the upper left when you log in, the decoded token will pop up:

In the token above, our privileges are in realm_access-> roles. If yours are somewhere else, you will need to specify where in the token they are with the STIGMAN_JWT_PRIVILEGES_CLAIM environment variable.

fyi, it looks like you are using an old version of STIG Manager, or at least an old config..... We've deprecated the STIGMAN_CLIENT_KEYCLOAK_CLIENTID environment variable in favor of the generic STIGMAN_CLIENT_ID since we support non-keycloak OIDC providers now. It's probably working for you now because "stig-manager" is our default client ID if one is not specified. STIGMAN_OIDC_PROVIDER is the new-style environment variable so you have something of a mixed environment.
I don't think we've changed anything in that area, however, that would be affecting your issue.

Hope that helps!