CODEWITHSUNDEEP
spring-bootoauth-2.0keycloakspring-restkeycloak-services
newstackoverflowuser5555
newstackoverflowuser5555

Reputation: 751

How does the authorization rules are validated by keycloak authorization server using spring rest adapter

I have set up the keycloak server and created the spring rest application with keycloak rest adapters. The Authorizations rules are working fine.

I would like to know about the internal working of the keycloak spring boot rest adapter. How the logged in user's token is validated against policy and permission set in keycloak admin client.

Upvotes: 5

Views: 1025

Answers (1)

Pulkit Gupta
Pulkit Gupta

Reputation: 1059

You are correct, access token does not contain all these details.

In Keycloak when you are using server side adapters the client will be configured to use the standard flow and not the implicit flow of OIDC.

In standard flow when you login using keycloak IDP your front-end redirects to Keycloak IDP and asks for you credentials. If you have the right credentials login is successful and you are redirected back to your app. In this redirect your app gets a code which it then sends to the back-end rest call. This code is used by spring adapter in the spring boot app to make a call to Keycloak IDP server and it is this call in which the boot application will get the user context to take all the authorization decisions as a response from the Keycloak server.

Hope this makes sense.

Upvotes: 2

Related Questions