Closed phxgbl closed 3 years ago
This JWT token is generated and returned by KeyCloak, so if anything is missing there, then you probably have to request additional scopes.
@simov thanks for the reply. Please check the decoded JWT token posted above. We can find "realm_access" Object which has the roles. But when mapped in Directus, the same is missing. So keycloak must be returning the roles right? So is there anything I have to do in Grantjs request to map the roles?
I don't know what mapping in Directus you are referring to, but as far as Grant is concerned everything returned from Keycloak is being returned to you. So that might be a question to ask in Directus repo instead.
@simov , I was confused where to ask.. Thanks for the help
@simov sorry for the confusion. Actually, I was referring to access_token(for Authorization) whereas GrantJs is using id_token for authentication which is absolutely correct. Is there any way to use access_token instead?
if (output.id_token) {
var jwt = oidc(provider, session, output)
if (jwt.error) {
return {provider, input, output: jwt}
}
}
It all depends on the provider in question. If the provider returns an id_token
and expects you to send it back for certain endpoints, then you need to do that. If the provider returns access_token
and it expects you to use that for other endpoints then that's what you need to do. This is not being controlled by Grant.
If your goal is to use Keycloak to login, and have access token for your API, then you can verify the id token, and then generate a JWT access token for your API. Here is an example for it.
@simov Thank you, I guess this is what I am looking for, that is getting information from access_token. Let me give a try.
@simov one more question, Keycloak returns both id_token and access_token, Is there any easy way(function) to decode access_token and get the details using Grant JS?
Currently that's not exposed, but you can use this code:
var jwt = (str) => {
var [header, payload, signature] = str.split('.')
return {
header: JSON.parse(Buffer.from(header, 'base64').toString('binary')),
payload: JSON.parse(Buffer.from(payload, 'base64').toString('utf8')),
signature,
}
}
Or you can use the jws module, which you will need to verify your access token on every request to your API.
@simov your code did the trick.
You were really helpfull .. Thanks a lot.
@simov I am trying to integrate Directus with Keycloak. Following is the JWT decode returned by the Keycloak
Login works correctly. The only thing missing is Authorization, I mean I cannot find Keycloak roles in the Grantjs decoded token. Config used are these:
Please help.