[prev in list] [next in list] [prev in thread] [next in thread]
List: keycloak-user
Subject: [keycloak-user] Can't invoke Keycloaks OpenID Connect token endpoint with grant type set to password
From: nicolas.duminil () simplex-software ! fr (Nicolas DUMINIL)
Date: 2017-12-26 16:22:19
Message-ID: 018b01d37e65$b4fcf630$1ef6e290$ () simplex-software ! fr
[Download RAW message or body]
Hi Vitali,
Thanks again for your help. Yes, you're right, the URL used in order to get the token \
was not the right one. Now, with the following client:
{
"id" : "ef4783a4-dc2f-49a8-8c4f-17521ce33240",get clients -r demo-realm --field
"clientId" : "curl",
"surrogateAuthRequired" : false,
"enabled" : true,
"clientAuthenticatorType" : "client-secret",
"redirectUris" : [ " <http://localhost> http://localhost" ],
"webOrigins" : [ " <http://localhost> http://localhost" ],
"notBefore" : 0,
"bearerOnly" : false,
"consentRequired" : false,
"standardFlowEnabled" : true,
"implicitFlowEnabled" : false,
"directAccessGrantsEnabled" : true,
"serviceAccountsEnabled" : true,
"authorizationServicesEnabled" : false,
"publicClient" : true,
"frontchannelLogout" : false,
"protocol" : "openid-connect",
"attributes" : {
"saml.assertion.signature" : "false",
"saml.force.post.binding" : "false",
"saml.multivalued.roles" : "false",
"saml.encrypt" : "false",
"saml_force_name_id_format" : "false",
"saml.client.signature" : "false",
"saml.authnstatement" : "false",
"saml.server.signature" : "false",
"saml.server.signature.keyinfo.ext" : "false",
"saml.onetimeuse.condition" : "false"
},
"fullScopeAllowed" : true,
"nodeReRegistrationTimeout" : -1,
"protocolMappers" : [ {
"id" : "b5b68fcc-0e26-486b-ab39-d8d8cf72eacc",
"name" : "role list",
"protocol" : "saml",
"protocolMapper" : "saml-role-list-mapper",
"consentRequired" : false,
"config" : {
"single" : "false",
"attribute.nameformat" : "Basic",
"attribute.name" : "Role"
}
}
and the following curl request:
curl --data "grant_type=password&client_id=curl&username=customer-manager-user&password=..." \
<http://localhost:18080/auth/realms/demo-realm/protocol/openid-connect/token> \
http://localhost:18080/auth/realms/demo-realm/protocol/openid-connect/token
I'm able to get the tocken. In deed, the parameter "directAccessGrantsEnabled" is now \
"true".
Many tanks for your help and support. This closes this issue.
Kind regards,
Nicolas
From: ??????? ?????? [mailto:betalb at gmail.com]
Sent: vendredi 22 d?cembre 2017 13:28
To: nicolas.duminil at simplex-software.fr
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Can't invoke Keycloaks OpenID Connect token endpoint \
with grant type set to password
Hello
I've missed one important thing in your first question: you've created client in \
demo-realm, but trying to get token in master realm
./keycloak/bin/kcadm.sh get clients/f3c2109d-9eb0-4fb3-b6be-32a52a691d42 -r \
demo-realm
http://localhost:18080/auth/realms/master/protocol/openid-connect/token
Also, I've mentioned that after you recreated client, direct grant \
(grant_type=password) was disabled (directAccessGrantsEnabled: false), in your \
previous version of client, it was enabled.
On Fri, Dec 22, 2017 at 2:49 PM Nicolas DUMINIL <nicolas.duminil at \
simplex-software.fr> wrote:
Hi,
Thanks for taking the time to reply to my post. I'm not sure why should I pass the \
client secret in the curl request. The tutorial I'm following doesn't do that. But \
anyway, the following command:
curl --data "grant_type=password&client_id=curl&username=customer-manager-user&password=toto&client-secret=f512e240-6cc0-4bd3-9d01-eb167b8e69e7" \
<http://localhost:18080/auth/realms/master/protocol/openid-connect/token> \
http://localhost:18080/auth/realms/master/protocol/openid-connect/token
raises the same exception:
{"error":"unauthorized_client","error_description":"UNKNOWN_CLIENT: Client was not \
identified by any client authenticator"}
Whatever I do, the result is the same. Here below I'm pasting again is the curl \
client that I have recreated:
{
"id" : "ef4783a4-dc2f-49a8-8c4f-17521ce33240",
"clientId" : "curl",
"surrogateAuthRequired" : false,
"enabled" : true,
"clientAuthenticatorType" : "client-secret",
"redirectUris" : [ "http://localhost" ],
"webOrigins" : [ "http://localhost" ],
"notBefore" : 0,
"bearerOnly" : false,
"consentRequired" : false,
"standardFlowEnabled" : true,
"implicitFlowEnabled" : false,
"directAccessGrantsEnabled" : false,
"serviceAccountsEnabled" : true,
"publicClient" : false,
"frontchannelLogout" : false,
"protocol" : "openid-connect",
"attributes" : {
"saml.assertion.signature" : "false",
"saml.force.post.binding" : "false",
"saml.multivalued.roles" : "false",
"saml.encrypt" : "false",
"saml_force_name_id_format" : "false",
"saml.client.signature" : "false",
"saml.authnstatement" : "false",
"saml.server.signature" : "false",
"saml.server.signature.keyinfo.ext" : "false",
"saml.onetimeuse.condition" : "false"
},
"fullScopeAllowed" : true,
"nodeReRegistrationTimeout" : -1,
"protocolMappers" : [ {
"id" : "b5b68fcc-0e26-486b-ab39-d8d8cf72eacc",
"name" : "role list",
"protocol" : "saml",
"protocolMapper" : "saml-role-list-mapper",
"consentRequired" : false,
"config" : {
"single" : "false",
"attribute.nameformat" : "Basic",
"attribute.name" : "Role"
}
}
Kind regards,
Nicolas
From: ??????? ?????? [mailto:betalb at gmail.com]
Sent: jeudi 21 d?cembre 2017 22:07
To: nicolas.duminil at simplex-software.fr
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Can't invoke Keycloaks OpenID Connect token endpoint \
with grant type set to password
You need to pass client secret, note this part in provided json: \
"clientAuthenticatorType" : "client-secret"
You can find client secret on UI or use kcadm.sh
./keycloak/bin/kcadm.sh get \
clients/f3c2109d-9eb0-4fb3-b6be-32a52a691d42/client-secret -r demo-realm
On Thu, Dec 21, 2017 at 6:22 PM Nicolas DUMINIL <nicolas.duminil at \
simplex-software.fr> wrote:
Hello,
I'm following this blog (
<http://blog.keycloak.org/2015/10/getting-started-with-keycloak-securing.htm
l>
http://blog.keycloak.org/2015/10/getting-started-with-keycloak-securing.html
) to secure some jax-rs services. I have the following client:
./keycloak/bin/kcadm.sh get clients/f3c2109d-9eb0-4fb3-b6be-32a52a691d42 -r
demo-realm
{
"id" : "f3c2109d-9eb0-4fb3-b6be-32a52a691d42",
"clientId" : "curl",
"surrogateAuthRequired" : false,
"enabled" : true,
"clientAuthenticatorType" : "client-secret",
"redirectUris" : [ " <http://localhost> http://localhost" ],
"webOrigins" : [ ],
"notBefore" : 0,
"bearerOnly" : false,
"consentRequired" : false,
"standardFlowEnabled" : true,
"implicitFlowEnabled" : false,
"directAccessGrantsEnabled" : true,
"serviceAccountsEnabled" : true,
"authorizationServicesEnabled" : false,
"publicClient" : true,
"frontchannelLogout" : false,
"protocol" : "openid-connect",
"attributes" : {
"saml.assertion.signature" : "false",
"saml.force.post.binding" : "false",
"saml.multivalued.roles" : "false",
"saml.encrypt" : "false",
"saml_force_name_id_format" : "false",
"saml.client.signature" : "false",
"saml.authnstatement" : "false",
"saml.server.signature" : "false",
"saml.server.signature.keyinfo.ext" : "false",
"saml.onetimeuse.condition" : "false"
},
"fullScopeAllowed" : true,
"nodeReRegistrationTimeout" : -1,
"protocolMappers" : [ {
"id" : "5916961f-e222-4a6d-968e-ca2031961168",
"name" : "family name",
"protocol" : "openid-connect",
"protocolMapper" : "oidc-usermodel-property-mapper",
"consentRequired" : true,
"consentText" : "${familyName}",
"config" : {
"userinfo.token.claim" : "true",
"user.attribute" : "lastName",
"id.token.claim" : "true",
"access.token.claim" : "true",
"claim.name" : "family_name",
"jsonType.label" : "String"
}
}
I'm doing the following curl request:
curl --data
"grant_type=password&client_id=curl&username=customer-manager-user&password=
toto"
<http://localhost:18080/auth/realms/master/protocol/openid-connect/token>
http://localhost:18080/auth/realms/master/protocol/openid-connect/token
and I get the following error:
{"error":"unauthorized_client","error_description":"UNKNOWN_CLIENT: Client
was not identified by any client authenticator"}
The user "customer-manager-user" is as follows:
[jboss at ca385990f977 ~]$ ./keycloak/bin/kcadm.sh get users -r demo-realm -q
username=customer-manager-user
[ {
"id" : "52f6b73c-0982-415d-9157-a4735bf619b1",
"createdTimestamp" : 1513861722307,
"username" : "customer-manager-user",
"enabled" : true,
"totp" : false,
"emailVerified" : false,
"disableableCredentialTypes" : [ "password" ],
"requiredActions" : [ ],
"notBefore" : 0,
"access" : {
"manageGroupMembership" : true,
"view" : true,
"mapRoles" : true,
"impersonate" : true,
"manage" : true
}
} ]
I have googled in order to find a solution and I found several persons
reporting the issue but I didn't find any solution. Many thanks in advance
for any help.
Kind regards,
Nicolas
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic