CH02 - Invoke Service return 403 but myrole is added to access_token about keycloak---identity-and-access-management-for-modern-applications-2nd-edition HOT 5 OPEN

Seeing the same issues. Did you manage to resolve it?

from keycloak---identity-and-access-management-for-modern-applications-2nd-edition.

Staring for a bit into the source code of keycloak-node-connect I think I figured out the issue in my case. Since it was something I created it might not be the same in your case but maybe it helps someone else.

The issue was I changed this line

app.get("/secured", keycloak.protect("realm:myrole"), function (req, res) {

to this

app.get("/secured",` keycloak.protect("myrealm:myrole"), function (req, res) {

Since I thought the realm has to be the name of the realm. But it is a description where the role should be looked for. The algorithm of the keycloak protector is here and the check for the role Token.prototype.hasRole that is uses is here.

Here is the working function with couple of printouts that might help you debug.

app.get("/secured", keycloak.protect("realm:myrole"), function (req, res) {
  let tok = req.kauth.grant.access_token;

  console.log(tok.hasRole("realm:myrole"));

  res.setHeader("content-type", "text/plain");
  res.send("Secret message!");
});

from keycloak---identity-and-access-management-for-modern-applications-2nd-edition.

I am having the same issue, any solutions?

from keycloak---identity-and-access-management-for-modern-applications-2nd-edition.

For me the problem was that in docker it wasn't working but running npm start directly was OK.

from keycloak---identity-and-access-management-for-modern-applications-2nd-edition.