如何从 KeyCloak 获取用户角色？

Question

I am trying to implement SSO in our app using keycloak-spring-security-adapter. The logging itself is working fine, but inside the app we have modules availability based on user roles/groups and i am not able to get user roles from SecurityContext to show users only what they should see.

    SecurityContext context = SecurityContextHolder.getContext();
    if(context.getAuthentication() != null) {
        KeycloakPrincipal principal = (KeycloakPrincipal) context.getAuthentication().getPrincipal();
        KeycloakSecurityContext session = principal.getKeycloakSecurityContext();
        AccessToken accessToken = session.getToken();
        AccessToken.Access realmAccess = accessToken.getRealmAccess();

        logger.info("KEYCLOAK ROLES: " + realmAccess.getRoles());

above logger for my user always gives this:

KEYCLOAK ROLES: [offline_access, uma_authorization]

And these are not the roles registered in keycloak server, because the one used for authenticating my user is:

GSAP_APPLICATION_SUPPORT

I am not able to log into the app with user that is not a member of any keycloak-registered groups so thats why i know this process works fine.

Is there a way of getting list of current user roles from keycloak based on userId/token?

Answer 1

Hardcoding the roles checking inside the service is not a best practice, it's a common approach to divide role based functionalities by API like:

api/v1/admin/**, api/v1/user/**

Using this you can restrict the access to API by roles:

 http.authorizeExchange()
                            .pathMatchers("your_endpoint").hasAnyRole("desired_role");

PS Please pay attention that keycloak adds the "ROLE_" prefix to the rolename, so you can

• use ROLE_admin, ROLE_user in your configuration

or

• use role names without "ROLE_" prefix (admin, user), and implement the JWT auth converter(example for Reactive (webFlux), you can do similar for Tomcat):

:

Converter<Jwt, ? extends Mono<? extends AbstractAuthenticationToken>> getJwtAuthenticationConverter() {var converter = new ReactiveJwtAuthenticationConverter();
converter.setJwtGrantedAuthoritiesConverter(jwt -> {
    Map<String, Object> realmAccess = jwt.getClaim("realm_access");
    Collection<String> roles = (Collection<String>) realmAccess.get("roles");
    return Flux.fromIterable(roles.stream()
            .map(role -> new SimpleGrantedAuthority("ROLE_" + role))
                    .toList());
});
return converter;

}