10

How can I get the the roles included in the reply of the userinfo endpoint in keycloak. I defined a "Role Mapping" for the user in keycloak. When I call the userinfo endpoint I get the fields like email name etc, but the roles are not included in the reply. When I call the auth endpoint I get the access_token and in the field scope has roles included. Here is the reply from the auth endpoint:

access_token" QJsonValue(string, "eyJhb...")
"expires_in" QJsonValue(double, 300)
"not-before-policy" QJsonValue(double, 0)
"refresh_expires_in" QJsonValue(double, 1800)
"refresh_token" QJsonValue(string, "eyJhb...")
"scope" QJsonValue(string, "profile email roles")
"session_state" QJsonValue(string, "20b48536-4b38-4aa6-9072-e8309833402e")
"token_type" QJsonValue(string, "bearer")

I also tried to call the userinfo endpoint with the attribute "scope=roles", but this didn't work.

Bumblebee
  • 431
  • 1
  • 4
  • 11
  • if you un-parse accessToken, there are user roles for all clients you assigned to. https://stackoverflow.com/questions/38552003/how-to-decode-jwt-token-in-javascript-without-using-a-library – Dmitri Algazin Sep 19 '19 at 09:15
  • Bumblebee, I may be able to help you out here, but I need more details so a few questions: 1. Are you able to see the roles in decoded token? -try https://jwt.io/ for decoding your token 2. How are you trying to extract fields from token - through javascript library or Java library? – tryingToLearn Sep 20 '19 at 04:41
  • tryingToLearn, yes, I can decode the token in jwt.io and can also see the roles. I would like to extract the fields in a Qt5 C++ application. – Bumblebee Oct 03 '19 at 04:36

4 Answers4

10

As someone already mentioned, it's a bug. I heard it's fixed in latest version of keycloak.

I eventually fixed with this setting without upgrading to the fixed version of keycloak.

When you add User Realm Role, it will have "realm_access.roles" as Token Claim Name. You need to change it to "roles". Then it will show correctly within userinfo.

enter image description here

handicop
  • 800
  • 11
  • 22
4

Should be this issue: https://keycloak.discourse.group/t/resource-access-claim-missing-from-userinfo-until-i-change-the-name/1238

When renaming the claim in Client Scopes -> roles -> Mappers -> realm roles/client roles, i.e. realm_access.roles to realm_accessy.roles (and setting Add to userinfo to ON), it is included in userinfo :-/

Torsten Römer
  • 3,764
  • 4
  • 38
  • 51
2

In the mapper page on Keycloak, there is a setting called Add to userinfo, that has to be enabled.

qdivision
  • 401
  • 2
  • 9
1

For those whose above answer didn't work, I have spent the whole day figuring it out.
Basically, you have to go to client Scopes--> roles --> then move to Mappers tab, select client roles Add to Id token, access token and userinfo on

Here is the Screenshot Client Roles

Suraj Rao
  • 28,850
  • 10
  • 94
  • 99
Kancer
  • 11
  • 1