Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Using Roles() results 403 Forbidden resource

See original GitHub issue

Using token validation method: ONLINE - @Roles({ roles: [‘basic’] }) returns 403 Forbidden for currently authenticated user with basic, although the role is assigned to realm and client.

{
    "exp": 1628960884,
    "iat": 1628960584,
    "auth_time": 1628960583,
    "jti": "365e237e-fcd0-441a-xxx-xxxxxxxxx",
    "iss": "http://localhost:8080/auth/realms/xxxxx",
    "sub": "33f9166d-4f4a-454f-9528-xxxxxxxxxxxx",
    "typ": "Bearer",
    "azp": "xyz-client",
    "session_state": "76f16231-xx-485c-b67f-xxxxx",
    "acr": "1",
    "allowed-origins": [
        "http://localhost:3000"
    ],
    "realm_access": {
        "roles": [
            "basic"
        ]
    },
    "resource_access": {
        "xyz-client": {
            "roles": [
                "basic",
                "pro"
            ]
        }
    },
    "scope": "profile email",
    "sid": "76f16231-xxx-xxxx-b67f-xxxxxxx",
    "email_verified": true,
    "name": "John Doe",
    "preferred_username": "john",
    "given_name": "John",
    "family_name": "Doe",
    "email": "john.doe@example.com"
}

Issue Analytics

State:
Created 2 years ago
Comments:10 (6 by maintainers)

Top GitHub Comments

2reactions

ferrerojoshcommented, Aug 15, 2021

I’ll take a look into this.

0reactions

ferrerojoshcommented, Aug 18, 2021

@ferrerojosh May I ask what version of Node are you using?

Can you please specify how to configure this Resource in Keycloak’s admin portal configuration?

With your setup

@Controller()
@Resource(Resouce.name)
export class AppController {
  constructor(private readonly appService: AppService) {}

  @Get()
  @Public(false)
  @Scopes('View')
  @Roles({ roles: ['basic'] })
  getHello(): string {
    return this.appService.getHello();
  }
}

I currently get the following:

[Nest] 38504   - 16.08.2021, 11:44:05   [Keycloak] Protecting resource [ Resouce ] with scopes: [ View ]
[Nest] 38504   - 16.08.2021, 11:44:05   [Keycloak] Resource [ Resouce ] denied to [ user1 ]

> node -v
v14.16.1

The realm setup is too long, its inside the example folder of this repository. You should find out more in Keycloak’s AuthZ documentation: https://www.keycloak.org/docs/latest/authorization_services/index.html