Keycloak newbie wants to do REST #12603

kwoot · 2022-06-20T15:16:19Z

kwoot
Jun 20, 2022

Hi,
I have a fresh 18.0 server with my own realm added and a user in it.
I like to connect to the rest api and get an access token.
I post to https://myserver:8443/auth/master/protocol/openid-connect/token or "auth/realms/master/protocol/openid-connect/token" or any other possible string with vars:
client_id: admin-cli
username: admin
grant_type: password
password: mysecretpassword

Whatever I try, I keep getting:
"error": "RESTEASY003210: Could not find resource for full path: https://myserver:8443/auth/master/protocol/openid-connect/token"

But a call to https://myserver:8443/realms/master does give me some nice json returned.
It even says: "token-service": "https://myserver:8443/realms/master/protocol/openid-connect" but trying that with the variables mentioned above also rsults in :
"error": "RESTEASY003210: Could not find resource for full path: https://myserver:8443/realms/master/protocol/openid-connect"

Trying with both GET and POST.

I have given the admin user every available role there is in a default system.

Am I forgetting something? Should I enable something using the admin GUI?
Any and all hints are hightly appreciated.

Answered by kwoot

Jun 21, 2022

Above can be ignored. It works with curl, so it took a while for me to find a solution.
In the end the following worked in Ansible.
(Personally I think this piece of code should be in the admin manual in some form).

vars:
    keycloak_server_url: https://ad.company.lan:8443
    realm: COMPANY.LAN

    - name: Retrieve token url from server
      uri:
        url: "{{ keycloak_server_url }}/realms/master"
        validate_certs: false
      register: tokenurl

    - debug:
        var: tokenurl.json["token-service"] 

    - name: Store url for easier retrieval
      set_fact:
        token_url: "{{ tokenurl.json[\"token-service\"] }}"

   - name: "Retrieve endpoint info for our realm {{ re…

View full answer

kwoot · 2022-06-21T13:11:20Z

kwoot
Jun 21, 2022
Author

Above can be ignored. It works with curl, so it took a while for me to find a solution.
In the end the following worked in Ansible.
(Personally I think this piece of code should be in the admin manual in some form).

vars:
    keycloak_server_url: https://ad.company.lan:8443
    realm: COMPANY.LAN

    - name: Retrieve token url from server
      uri:
        url: "{{ keycloak_server_url }}/realms/master"
        validate_certs: false
      register: tokenurl

    - debug:
        var: tokenurl.json["token-service"] 

    - name: Store url for easier retrieval
      set_fact:
        token_url: "{{ tokenurl.json[\"token-service\"] }}"

   - name: "Retrieve endpoint info for our realm {{ realm }}"
      uri:
        url: "{{ keycloak_server_url }}/realms/{{ realm }}/.well-known/openid-configuration"
        validate_certs: false
      register: endpointinfo

    - debug:
        var: endpointinfo
  
    - name: Store authorization_endpoint for faster retrieval
      set_fact:
        authorization_endpoint: "{{ endpointinfo.json[\"authorization_endpoint\"] }}"
    - debug:
        var: authorization_endpoint

    - name: Store token_endpoint for faster retrieval
      set_fact:
        token_endpoint: "{{ endpointinfo.json[\"token_endpoint\"] }}"
    - debug:
        var: token_endpoint

    - name: Store userinfo_endpoint for faster retrieval
      set_fact:
        userinfo_endpoint: "{{ endpointinfo.json[\"userinfo_endpoint\"] }}"
    - debug:
        var: userinfo_endpoint

0 replies

abstractj · 2022-06-27T19:25:58Z

abstractj
Jun 27, 2022
Maintainer

@kwoot there's no need to delete your post. Other community members may find the information here useful.

1 reply

kwoot Jun 30, 2022
Author

Well, they sure will now! :-)

jaymberry · 2022-06-29T19:50:44Z

jaymberry
Jun 29, 2022

I will add to this thread with Curl Rest problem. I have keycloak running on a kubernetes cluster with ingress setup. I can login and connect grafana to it. Not sure what the issue below is.

imports/test-realm.json:

  {
    "id": "newrealm",
    "realm": "newrealm",
    "displayName": "New Realm",
    "enabled": true,
    "sslRequired": "external",
    "registrationAllowed": false,
    "loginWithEmailAllowed": true,
    "duplicateEmailsAllowed": false,
    "resetPasswordAllowed": false,
    "editUsernameAllowed": false,
    "bruteForceProtected": true
  }

Process:

FILE_NAME=imports/test-realm.json

ACCESS_TOKEN=$(curl -k \
  -d "client_id=admin-cli" \
  -d "username=admin" \
  -d "password=admin" \
  -d "grant_type=password" \
  "https://keycloak/auth/realms/master/protocol/openid-connect/token" | jq '.access_token')

# Works
curl -k \
  -H "Authorization: bearer $ACCESS_TOKEN" \
  "https://keycloak/auth/realms/master"

# Does not work, see result below.
curl -k -v POST \
    -H "Authorization: Bearer $ACCESS_TOKEN" \
    -H "Content-Type: application/json" \
    -d @"${FILE_NAME}" https://keycloak/auth/admin/realms

Result:

curl: (6) Could not resolve host: POST
{"error":"HTTP 401 Unauthorized"}

Thank you

1 reply

jaymberry Jun 30, 2022

Found the solution, it was double quotes on the token when using jq, see comments and statements below.

# The problem with this method is that the resulting token is surrounded by double quotes and does not work.
ACCESS_TOKEN=$(curl -k \
  -d "client_id=admin-cli" \
  -d "username=<user_name>" \
  -d "password=<user_pw>" \
  -d "grant_type=password" \
  "https://keycloak/auth/realms/master/protocol/openid-connect/token" | jq '.access_token')

# This method removes the quotes and works.
RESULT=`curl -k --data "username=<user_name>&password=<user_pw>&grant_type=password&client_id=admin-cli" https://keycloak/auth/realms/master/protocol/openid-connect/token`
ACCESS_TOKEN=`echo $RESULT | sed 's/.*access_token":"//g' | sed 's/".*//g'`

FILE_NAME=imports/test-realm.json

curl -k -v POST \
    -H "Authorization: Bearer $ACCESS_TOKEN" \
    -H "Content-Type: application/json" \
    -d @"${FILE_NAME}" https://keycloak/auth/admin/realms

Keycloak newbie wants to do REST #12603

Uh oh!

Uh oh!

kwoot Jun 20, 2022

Replies: 3 comments · 2 replies

Uh oh!

Uh oh!

kwoot Jun 21, 2022 Author

Uh oh!

abstractj Jun 27, 2022 Maintainer

Uh oh!

kwoot Jun 30, 2022 Author

Uh oh!

Uh oh!

jaymberry Jun 29, 2022

Uh oh!

Uh oh!

jaymberry Jun 30, 2022

kwoot
Jun 20, 2022

Replies: 3 comments 2 replies

kwoot
Jun 21, 2022
Author

abstractj
Jun 27, 2022
Maintainer

kwoot Jun 30, 2022
Author

jaymberry
Jun 29, 2022