Require a certain role or group membership to allow login

[col-panic]

Optionally require a certain role or group membership to allow login. (e.g. the user must have the client role redmine-user to be allowed login in the system)

[ok2uec]

I need that as well. The only thing I'm missing is role mapping after login.

[picman]

What OAuth provider do you use? In Azure it should be possible in general. If you specify groupMembershipClaims, then we should get the access token with a list of groups. If you have the option to set the groupMembershipClaims in your application, I can create a branch where I log the access token to see whether some groups are present and in in format. I can't test it myself as I have no direct access to Azure administration.
https://stackoverflow.com/questions/54868974/getting-security-groups-in-jwt-access-token

[col-panic]

We have a Keycloak Realm with multiple users. Now I only want a subset of this users to be able to login to Redmine. Keyloak is an Authentication tool, while the task of authorization is done by the Resource Provider (in this case Redmine).
At the moment redmine_oauth does only require a user to successfully authenticate against a realm to be able to login as user. This already leaves projects marked as "public" open to this user.

(There exists an extension to block a user from getting a client token in https://github.com/sventorben/keycloak-restrict-client-auth - but as mentioned, this is considered to be a task of the resource provider)

The basic approach would be, that a client role user is introduced, and if the token represented by the user does not contain a role like resource_access.redmine.user then access is not granted.

In the following IDToken I added myself to a newly required client role user

{
  "exp": 1724998286,
  "iat": 1724997986,
  "jti": "fb1d6fb5-1734-4c16-ab98-4e008b9ffefd",
  "iss": "https://***/realms/***",
  "aud": "redmine",
  "sub": "8e82f27a-39cf-4540-a308-ddd8c94e6a5d",
  "typ": "ID",
  "azp": "redmine",
  "sid": "dddeb1de-ebd8-4c6f-913e-290ae5d5f8ac",
  "acr": "1",
  "resource_access": {
    "redmine": {
      "roles": [
        "user"
      ]
    }
  },
  "email_verified": true,
  "name": "Marco Descher",
  "preferred_username": "mdescher",
  "given_name": "Marco",
  "family_name": "Descher",
  "email": "***@***"
}

the mapping to resource_access.redmine.roles is keycloaks default to map a users client.role. The location
should however be configurable. This role could also be mapped to the access token. I asumme, however, that
you are reading the IDToken.

So the following extensions could be realize:

1. Required the client role user to be authorized to login to redmine. (This feature could be optional. If someone has a setup where having a valid user on the openid server is already enough, then we would not need to check this)
2. EXTENSION Connection to Map Administrator role #37 if e.g. the token has a value like this

"resource_access": {
    "redmine": {
      "roles": [
        "user", "admin"
      ]
    }
  }

then the user could already be granted the Administrator privileges. Some way round - if admin is not part of the token anymore, then the admin rights should be removed.
3. EXTENSION Introducing groups which could then contain memberships to groups as used within redmine. But I don't elaborate on this here. If we come to this point, I'll create a separate issue explaining in detail.

[picman]

Could you test roles branch with your Keycloak configuration?

[col-panic]

@picman thank you for your response, I added some comments to e1f6a68

[picman]

Updated accordingly.

[col-panic]

Validate user roles = resource_access.mis.roles

If none of the roles is mapped, then this happens:

mis-echo-1  | OAuth2::AccessToken.from_hash: `hash` contained more than one 'token' key (["access_token", "id_token"]); using "access_token".
mis-echo-1  | E, [2024-09-05T13:23:35.291165 #1] ERROR -- : undefined method `[]' for nil:NilClass

it is correct not to let me in - but there should be a better message :)

if user role is mapped the same happens for the access token

{
  "exp": 1725543182,
  "iat": 1725542882,
  "jti": "433d0ae4-3821-499c-9eee-06f061685acd",
  "iss": "https://keycloak.medelexis.ch/realms/Medelexis",
  "sub": "c64712b8-a25b-4368-82e0-a73d5fb7c944",
  "typ": "Bearer",
  "azp": "mis",
  "sid": "b9957d40-8c9e-4881-ba03-92eb636de2eb",
  "acr": "1",
  "allowed-origins": [
    "/*"
  ],
  "resource_access": {
    "mis": {
      "roles": [
        "user"
      ]
    }
  },
  "scope": "openid profile email",
  "email_verified": true,
  "name": "Test flawil",
  "preferred_username": "tester",
  "locale": "de",
  "given_name": "Test",
  "family_name": "flawil",
  "email": "tester@tester.at"
}

[picman]

1. How does look the token if "none of the roles is mapped"?
2. What do you mean with "the same happens for the access token"?

[col-panic]

• Keycloak seems to deliver both tokens. I think you should focus for the id_token currently it seems to select the access_token
• With no role granted at all, the id_token looks like this

{
  "exp": 1725547546,
  "iat": 1725547246,
  "jti": "1e939b4e-9df2-412d-89a7-89b77e5e9363",
  "iss": "https://keycloak.medelexis.ch/realms/Medelexis",
  "aud": "mis",
  "sub": "c64712b8-a25b-4368-82e0-a73d5fb7c944",
  "typ": "ID",
  "azp": "mis",
  "sid": "a83e1b4e-c707-4a8b-b14a-ee806bf35708",
  "acr": "1",
  "email_verified": true,
  "name": "Test flawil",
  "preferred_username": "tester",
  "locale": "de",
  "given_name": "Test",
  "family_name": "flawil",
  "email": "tester@tester.at"
}

the access-token like this

{
  "exp": 1725547546,
  "iat": 1725547246,
  "jti": "c201968e-4c78-4124-a244-5b37e1ea6064",
  "iss": "https://keycloak.medelexis.ch/realms/Medelexis",
  "sub": "c64712b8-a25b-4368-82e0-a73d5fb7c944",
  "typ": "Bearer",
  "azp": "mis",
  "sid": "7efbb610-e786-43c4-aaee-9cc02dc1f02a",
  "acr": "1",
  "allowed-origins": [
    "/*"
  ],
  "scope": "openid profile email",
  "email_verified": true,
  "name": "Test flawil",
  "preferred_username": "tester",
  "locale": "de",
  "given_name": "Test",
  "family_name": "flawil",
  "email": "tester@medevit.at"
}

• With the role user granted for the client, the id_token looks like this

{
  "exp": 1725547853,
  "iat": 1725547553,
  "jti": "99f42891-d424-4bc7-b403-3a41967ef884",
  "iss": "https://keycloak.medelexis.ch/realms/Medelexis",
  "aud": "mis",
  "sub": "c64712b8-a25b-4368-82e0-a73d5fb7c944",
  "typ": "ID",
  "azp": "mis",
  "sid": "ae6b6e47-a4f3-4d35-841b-27bdc395119b",
  "acr": "1",
  "resource_access": {
    "mis": {
      "roles": [
        "user"
      ]
    }
  },
  "email_verified": true,
  "name": "Test flawil",
  "preferred_username": "tester",
  "locale": "de",
  "given_name": "Test",
  "family_name": "flawil",
  "email": "tester@tester.at"
}

the access_token like this

{
  "exp": 1725547853,
  "iat": 1725547553,
  "jti": "107e0d71-7bb8-4de0-b759-85245ace0623",
  "iss": "https://keycloak.medelexis.ch/realms/Medelexis",
  "sub": "c64712b8-a25b-4368-82e0-a73d5fb7c944",
  "typ": "Bearer",
  "azp": "mis",
  "sid": "c6377cd2-2303-4984-b2b3-86585d1eaec7",
  "acr": "1",
  "allowed-origins": [
    "/*"
  ],
  "resource_access": {
    "mis": {
      "roles": [
        "user"
      ]
    }
  },
  "scope": "openid profile email",
  "email_verified": true,
  "name": "Test flawil",
  "preferred_username": "tester",
  "locale": "de",
  "given_name": "Test",
  "family_name": "flawil",
  "email": "tester@tester.at"
}

for all these combinations I receive

mis-echo-1  | OAuth2::AccessToken.from_hash: `hash` contained more than one 'token' key (["access_token", "id_token"]); using "access_token".
mis-echo-1  | E, [2024-09-05T14:47:40.218602 #1] ERROR -- : undefined method `[]' for nil:NilClass