{"action":"created","issue":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/6939","repository_url":"https://api.github.com/repos/jhipster/generator-jhipster","labels_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/6939/labels{/name}","comments_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/6939/comments","events_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/6939/events","html_url":"https://github.com/jhipster/generator-jhipster/issues/6939","id":285635090,"number":6939,"title":"OIDC and authorization management","user":{"login":"danielpetisme","id":593564,"avatar_url":"https://avatars1.githubusercontent.com/u/593564?v=4","gravatar_id":"","url":"https://api.github.com/users/danielpetisme","html_url":"https://github.com/danielpetisme","followers_url":"https://api.github.com/users/danielpetisme/followers","following_url":"https://api.github.com/users/danielpetisme/following{/other_user}","gists_url":"https://api.github.com/users/danielpetisme/gists{/gist_id}","starred_url":"https://api.github.com/users/danielpetisme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielpetisme/subscriptions","organizations_url":"https://api.github.com/users/danielpetisme/orgs","repos_url":"https://api.github.com/users/danielpetisme/repos","events_url":"https://api.github.com/users/danielpetisme/events{/privacy}","received_events_url":"https://api.github.com/users/danielpetisme/received_events","type":"User","site_admin":false},"labels":[{"id":794192736,"url":"https://api.github.com/repos/jhipster/generator-jhipster/labels/Keycloak","name":"Keycloak","color":"45a9d3","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-01-03T09:30:07Z","updated_at":"2018-03-16T12:32:26Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"<!--\r\n- Please follow the issue template below for bug reports and feature requests.\r\n- If you have a support request rather than a bug, please use [Stack Overflow](http://stackoverflow.com/questions/tagged/jhipster) with the JHipster tag.\r\n- For bug reports it is mandatory to run the command `jhipster info` in your project's root folder, and paste the result here.\r\n- Tickets opened without any of these pieces of information will be **closed** without any explanation.\r\n-->\r\n\r\n##### **Overview of the issue**\r\n\r\n<!-- Explain the bug or feature request, if an error is being thrown a stack trace helps -->\r\n\r\n##### **Motivation for or Use Case**\r\n\r\n<!-- Explain why this is a bug or a new feature for you -->\r\n\r\n##### **Reproduce the error**\r\n\r\n<!-- For bug reports, an unambiguous set of steps to reproduce the error -->\r\n\r\nCurrent status: The keycloak settings export the Realm roles into a user attribute to make them visible when we hit the `userinfo` endpoint. \r\nAfter a deeper look, I'm not sure it's a best practices:\r\n1- `userinfo` aims to provide a user identity (thus the `openid` scope requires) but not the roles\r\n2- it forces to have a custom claims, not very flexible with other IdP providers\r\n3- The access token already host the roles.\r\n\r\nMy first conclusion would be to rely on the access token rather than userinfo to retrieve the roles but still the claims for roles is not standard. For Keycloak for instance your will have:\r\n```\r\n...\r\n\"realm_access\": {\r\n    \"roles\": [\r\n      \"ROLE_USER\",\r\n      \"ROLE_ADMIN\",\r\n      \"uma_authorization\"\r\n    ]\r\n  },\r\n  \"resource_access\": {\r\n    \"account\": {\r\n      \"roles\": [\r\n        \"manage-account\",\r\n        \"manage-account-links\",\r\n        \"view-profile\"\r\n      ]\r\n    }\r\n...\r\n```\r\n\r\nMost of the case, the roles will be in the `realm_access.roles` document but not perfect. The actual code has to be updated since it will not rely on the `UserInfoTokenServices` anymore (I've a POC made).\r\n\r\nSo I continued my reading and found that most IdP proposes Authorization services on top of Identity management. That means delegating the resources protection to Keycloak for instance.\r\nIn a microservices architecture this could make sense but means also that each request will be tested against the authorization server (I don't know yet if the authorization can be merged with the token validation request).\r\n\r\nI'm not 100% satisfied with the current implementation of roles management with Keycloak seems it relies on a hardcoded specific claim (and I already had the issue). \r\n\r\nDelegating the authorization to keycloak looks seducing but I don't no the complexity it will introduce neither the future developer experience. \r\n\r\nWhat do you think @mraible \r\n\r\n##### **Related issues**\r\n\r\n<!-- Has a similar issue been reported before? Please search both closed & open issues -->\r\n\r\n##### **Suggest a Fix**\r\n\r\n<!-- For bug reports, if you can't fix the bug yourself, perhaps you can point to what might be\r\n  causing the problem (line of code or commit) -->\r\n\r\n##### **JHipster Version(s)**\r\n\r\n<!--\r\nWhich version of JHipster are you using, is it a regression?\r\n-->\r\n\r\n##### **JHipster configuration**\r\n\r\n<!--\r\nTo provide all information we need, you should run `jhipster info` in the project root folder, and\r\ncopy/paste the result here.\r\nThe `.yo-rc.json` file generated in the root folder is mandatory for bug reports. This will help us to replicate the scenario.\r\nYou should remove any sensitive information like the rememberMe key or the jwtSecretKey key.\r\n-->\r\n\r\n##### **Entity configuration(s) `entityName.json` files generated in the `.jhipster` directory**\r\n\r\n<!--\r\nIf the error is during an entity creation or associated with a specific entity.\r\nIf you are using JDL, please share that configuration as well.\r\n-->\r\n\r\n##### **Browsers and Operating System**\r\n\r\n<!-- What OS are you on? is this a problem with all browsers or only IE8? -->\r\n\r\n- [ ] Checking this box is mandatory (this is just to show you read everything)\r\n\r\n<!-- Love JHipster? Please consider supporting our collective:\r\n👉  https://opencollective.com/generator-jhipster/donate -->\r\n"},"comment":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/comments/373699576","html_url":"https://github.com/jhipster/generator-jhipster/issues/6939#issuecomment-373699576","issue_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/6939","id":373699576,"user":{"login":"yelhouti","id":5471639,"avatar_url":"https://avatars1.githubusercontent.com/u/5471639?v=4","gravatar_id":"","url":"https://api.github.com/users/yelhouti","html_url":"https://github.com/yelhouti","followers_url":"https://api.github.com/users/yelhouti/followers","following_url":"https://api.github.com/users/yelhouti/following{/other_user}","gists_url":"https://api.github.com/users/yelhouti/gists{/gist_id}","starred_url":"https://api.github.com/users/yelhouti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yelhouti/subscriptions","organizations_url":"https://api.github.com/users/yelhouti/orgs","repos_url":"https://api.github.com/users/yelhouti/repos","events_url":"https://api.github.com/users/yelhouti/events{/privacy}","received_events_url":"https://api.github.com/users/yelhouti/received_events","type":"User","site_admin":false},"created_at":"2018-03-16T12:32:26Z","updated_at":"2018-03-16T12:32:26Z","author_association":"NONE","body":"Before spring security 5 checking the OIDC token wasn't builtin: checking the signature + client.... I think this should be done now.\r\nFew things to take into account:\r\n- keycloak has realm-roles and client-roles we should decide what to take.\r\n- should we use the keycloak adapter provided by keycloak"}}
{"actor":{"display_login":"yelhouti"}}