Using keycloak-authz-client (6.0.1) only (no Spring Security), I need to read user informations AND user groups from my service provider.
After getting a proper access token, thanks to the AuthzClient, I was able to reach user information API:
UriBuilder target = UriBuilder.fromUri(kcURL);
target.path("realms/{realm}/protocol/openid-connect/userinfo")
.resolveTemplate("realm", this.realm);
UserInfoOIDC info = new UserInfoOIDC();
try {
UserInfo response = this.buildBearerInvocation(target, accessToken).get(UserInfo.class);
info.setName(response.getName());
info.setUsername(response.getPreferredUsername());
info.setCompleted(true);
log.info("User info successfully retrieved from {}", this.realm);
} catch (WebApplicationException e) {
log.error("User info failure on {}: {}", this.realm, e.getMessage());
}
...
private Invocation.Builder buildBearerInvocation(UriBuilder target, String accessToken) {
WebTarget webTarget = restClient.target(target);
Invocation.Builder builder = webTarget.request(APPLICATION_JSON)
.header(AUTHORIZATION, "Bearer " + accessToken);
return builder;
}
But I couldn't access the "admin API":
UriBuilder target = UriBuilder.fromUri(kcURL);
target.path("admin/realms/" + this.realm);
target.path("users/" + userId);
target.path("groups");
try {
return this.buildBearerInvocation(target, accessToken)
.get(GroupRepresentation.class);
} catch (WebApplicationException e) {
log.error("User groups failure on realms {}: {}", this.realm, e.getMessage());
}
[main] INFO com.LoggingFilter - Processing http://localhost:8080/auth/admin/realms/TestRealm/users/0f443554-01d0-4b40-a652-0c8c174632d4/groups [main] ERROR com.KeycloakProvider - User groups failure on realms TestRealm: HTTP 403 Forbidden
I'm wondering if that might simply come from insufficient user access rights or rather from a CORS issue here (I've added "127.0.0.1 localhost-auth" to my etc/hosts file, not sure at all that would be of any help here, though). How can I open the "admin API" to a user, more CORS configuration or any special role for the user?
EDITED - the Keycloak Admin Client won't help here (HTTP 403 Forbidden as well):
@Test
public void checkKeycloakAdminClient() {
Keycloak client = KeycloakBuilder.builder()
.serverUrl(url)
.realm(realm)
.username(adminUsername)
.password(adminPassword)
.clientId(clientId)
.clientSecret(clientSecret)
.build();
RealmResource realmResource = client.realm(realm);
UsersResource usersResource = realmResource.users();
List<UserRepresentation> users = usersResource.search(username);
}
Assign all "view-..." and "query-..." available Client Roles from "realm-management" realm's client to the admin user (see User/Role Mappings).