Replies: 2 comments 8 replies
-
|
/cc @pedroigor (keycloak), @sberyozkin (keycloak) |
Beta Was this translation helpful? Give feedback.
-
|
@SetoKaiba Is the bearer token already available ? If yes then you can decode it and check the claims or use it to fetch UserInfo from the KC UserInfo endpoint, otherwise you can try https://quarkus.io/guides/security-keycloak-admin-client, but as far as I know no roles can be currently retrieved from Keycloak with this API. |
Beta Was this translation helpful? Give feedback.
-
|
@sberyozkin Hi. I know that I can use {
"realmMappings": [
{
"id": "26ee4c05-3e65-45c6-aee8-a9a4cf7fa666",
"name": "default-roles-ciyuan",
"description": "${role_default-roles}",
"composite": true,
"clientRole": false,
"containerId": "31025b79-fb5e-4ed6-8f81-eaa0729aeef7"
},
{
"id": "445373dc-461c-4248-9d9a-3b0356bb42e5",
"name": "admin",
"description": "",
"composite": false,
"clientRole": false,
"containerId": "31025b79-fb5e-4ed6-8f81-eaa0729aeef7"
}
]
}So I try to use the quarkus keycloak admin client. But I can't connect to the server with admin client. Keycloak keycloak = KeycloakBuilder.builder()
.serverUrl("https://keycloak.kaiba.net:8543")
.realm("master")
.clientId("admin-cli")
.username("admin")
.password("xxx")
.grantType("password")
.build();It reports SSL error.But my server is with SSL certificate. And also, it's working with postman and quarkus-oidc. Can you please help? |
Beta Was this translation helpful? Give feedback.
-
|
@SetoKaiba May be try without the port ? How do you configure it with oidc ? |
Beta Was this translation helpful? Give feedback.
-
|
@SetoKaiba Keycloak admin client can now skip the host verification too if a quarkus tls trust all property is set. As far as the injected keycloak client being the blocking one, as opposed to the one built programmatically , @michalvavrik , what do you think? |
Beta Was this translation helpful? Give feedback.
-
|
Thank you. I'll have a try. |
Beta Was this translation helpful? Give feedback.
-
|
As far as logged exception mentioned above goes, I think you probably use self-generated cert? First I'd try to ensure it works without host verification as Sergey mentioned.
Which context, are you referring to the CDI request context? If yes, I think I made it request scoped to avoid resource leak as it is closeable and I didn't want to hold it open for whole running time while you might only need to use it (in some scenarios) on app startup etc. So I'd say you can use (If not, it would be for the best to have reproducer so that we can help effectively) |
Beta Was this translation helpful? Give feedback.
-
Thank you for your replay. @michalvavrik No. I'm not using self-signed cert. It's normal cert. Here's my server url. You can have a try. https://keycloak.kaiba.net:8543
Yes. I mean the CDI request context. And here's my case. Previously, I used the injected keycloak instead of the one build programmatically. The CDI request context become inactive when it's run in CompletableFuture. The reason why I use CompletableFuture is that I can't use blocking code inside of reactive resteasy method. @Path("/room/{roomId36}/isPublishPermitted")
@GET
@WithTransaction
public Uni<LiveResponse> isPublishPermitted(String roomId36) {
Long roomId = KeygenUtil.decode(roomId36);
UUID userId = UUID.fromString(jsonWebToken.getSubject());
return isPublishPermitted(roomId, userId, serverUrl, realm, clientId, clientSecret, grantType, realmName, logger);
}
public static Uni<LiveResponse> isPublishPermitted(Long roomId, UUID userId, String serverUrl, String realm, String clientId, String clientSecret, String grantType, String realmName, Logger logger) {
return User.<User>findById(userId).chain(user -> Room.<Room>findById(roomId).chain(room -> {
if (room == null) {
return Uni.createFrom().item(new LiveResponse(LiveResponse.CODE_DOES_NOT_EXIST, "room does not exist"));
} else {
if (room.roomPublishType == Room.RoomPublishType.ALL) {
return Uni.createFrom().item(new LiveResponse(LiveResponse.CODE_OK, "ok"));
} else {
Context context = io.vertx.core.Vertx.currentContext();
CompletableFuture<Boolean> future = new CompletableFuture<>();
CompletableFuture.runAsync(() -> {
try {
boolean found = false;
Keycloak kc = KeycloakBuilder.builder().serverUrl(serverUrl).realm(realm).clientId(clientId).clientSecret(clientSecret).grantType(grantType).build();
for (RoleRepresentation realmMapping : kc.realm(realmName).users().get(userId.toString()).roles().getAll().getRealmMappings()) {
if (realmMapping.getName().equals("admin")) {
found = true;
}
}
future.complete(found);
} catch (Exception e) {
logger.error("keycloak get roles error", e);
}
});
return Uni.createFrom().future(future).emitOn(command -> context.runOnContext(x -> command.run())).chain(flag -> {
if (flag) {
return Uni.createFrom().item(new LiveResponse(LiveResponse.CODE_OK, "ok"));
} else if (room.owner.equals(user)) {
return Uni.createFrom().item(new LiveResponse(LiveResponse.CODE_OK, "ok"));
} else {
switch (room.roomPublishType) {
case SUBSCRIBERS_ONLY:
return Mutiny.fetch(room.subscribers).map(set -> {
if (room.subscribers.contains(user)) {
return new LiveResponse(LiveResponse.CODE_OK, "ok");
} else {
return new LiveResponse(LiveResponse.CODE_PUBLISH_IS_NOT_PERMITTED, "Publish is not permitted");
}
});
case PERMITTED_PUBLISH_USERS_ONLY:
return Mutiny.fetch(room.permittedPublishUsers).map(set -> {
if (room.permittedPublishUsers.contains(user)) {
return new LiveResponse(LiveResponse.CODE_OK, "ok");
} else {
return new LiveResponse(LiveResponse.CODE_PUBLISH_IS_NOT_PERMITTED, "Publish is not permitted");
}
});
}
}
return Uni.createFrom().item(new LiveResponse(LiveResponse.CODE_PUBLISH_IS_NOT_PERMITTED, "Publish is not permitted"));
});
}
}
}));
} |
Beta Was this translation helpful? Give feedback.
-
|
I don't see your SSL context setup and I can't help with that part. And I can't tell if request context should be deactivated while asynchronous method is still executed, my bet would be on yes as it looks very complicated to do it differently. For that I think you should activate |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Is there a way to get the roles of specified user id with Quarkus and Keycloak? I have a web hook for streaming server with user id. So I can't use the Identity Manager Provider to authenticate the user to get the info. Is there a way to get it without authenticate the user? And it's just for Quarkus backend. I have the keycloak backend secret.
Beta Was this translation helpful? Give feedback.
All reactions