Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Multi-level OIDC_ROLE_CLAIM and OIDC_GROUP_CLAIM

See original GitHub issue

Is your feature request related to a problem? Please describe. I use Keycloak as OIDC provider and want to use OIDC_GROUP_CLAIM and OIDC_ROLE_CLAIM. But Keycloak reponds with a multi-level claim structure which is currently not possible to use.

{
  "name": "Me",
  "email": "me@example.com",
  "realm_access": {
    "roles": [
      "just_some_generic_roles"
    ]
  },
  "resource_access": {
    "RANDOM_OAUTH2_CLIENT_ID": {
      "roles": [
        "my_role_1",
        "my_role_2"
      ]
    }
  }
}

Describe the solution you’d like According to the data above I need something like resource_access/RANDOM_OAUTH2_CLIENT_ID/roles as OIDC_GROUP_CLAIM and OIDC_ROLE_CLAIM. This leads to data.get('resource_access').get('RANDOM_OAUTH2_CLIENT_ID').get('roles') at https://github.com/alerta/alerta/blob/master/alerta/auth/oidc.py#L123.

Describe alternatives you’ve considered I’m not the supporter of the Keycloak server so it’s impossible to have the alternative on the server side.

Issue Analytics

State:
Created 4 years ago
Comments:24 (24 by maintainers)

Top GitHub Comments

1reaction

satterlycommented, Sep 10, 2019

You can find the JWT in any API XHR request. Using the javascript console go to the Network tab and filter on “XHR” requests. Choose Headers and then find the “Authorization” header. The bearer token is the JWT (highlighted in blue below).