keycloak impossible to get client-roles inside access_token

Question

I'm new with keycloak and following a tutorial over internet, I've configured a new realm "example" with a client "app-backend", related role "admin" (not composed) and realm role "app-admin"(composed with the client role "admin").

I've also created one user and I've assigned the realm role "admin". All ok at this point but, when I ask for access token with the POST API call to keycloak server(http://localhost:8080/auth/realms/barber-reservation/protocol/openid-connect/token), I've noticed that client roles are not contained inside the "resource_access" object, instead I've found "account" object inside it.

This strange behavior is making fail all authorization verification from my spring boot app.

Following the acess token received:

{
  "exp": 1608478284,
  "iat": 1608477984,
  "jti": "5ce17d4d-e3b3-4207-8010-45c0895a9a6a",
  "iss": "http://localhost:8080/auth/exmple/app-backend",
  "aud": [
    "app-backend"
  ],
  "sub": "d3fcc7df-878e-4363-91d6-f06437de5f90",
  "typ": "Bearer",
  "azp": "app-frontend",
  "session_state": "dad4ab85-850a-4c63-8a26-7b3b6de9f821",
  "acr": "1",
  "allowed-origins": [
    "*"
  ],
  "realm_access": {
    "roles": [
      "app-admin"
    ]
  },
    "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    },
    "app-backend": {
      "roles": [
        "admin"
      ]
    }
  },
  "scope": "openid email profile",
  "email_verified": true,
  "name": "Name Surname",
  "preferred_username": "[email protected]",
  "locale": "it",
  "given_name": "Name",
  "family_name": "Surname",
  "email": "[email protected]"
}

I was expecting that the client roles section was contained inside the "resource_access" object like this:

"resource_access": {
   "app-backend": {
      "roles": [
        "admin"
      ]
    }
}

Any Ideas on how to correct this strange behaviour? Thank you.

dreamcrash dreamcrash · Accepted Answer · 2020-12-20T18:11:26

There is nothing strange here, your client role admin from the client "app-backend" is on the resource_access object:

"resource_access": 
  {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    },
    "app-backend": {
      "roles": [
        "admin"
      ]
    }
  },

The resource_access is a list of Key Values, i.e., client and their roles.

keycloak impossible to get client-roles inside access_token

1 Answers