keycloack client credentials --> 401 - oauth-2.0

Question

I have a problem with keycloak and oauth2 identification.
I use client_credentials grant type to request an access_token :
curl --location --request POST 'https://XXX/realms/YYY/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=CCC' \
--data-urlencode 'client_secret=6yqR3IEE...' \
--data-urlencode 'grant_type=client_credentials'
{
"access_token": "eyJhbGciOiJS.....",
"expires_in": 300,
"refresh_expires_in": 0,
"token_type": "Bearer",
"not-before-policy": 0,
"scope": "profile good-service email groups"
}
Seems ok. and verification on jwt.io confirm.
{
"exp": 1673290210,
"iat": 1673289910,
"jti": "b948569a-9597-4e1d-aab8-b95a24550965",
"iss": "https://XXX/realms/YYY",
"aud": "account",
"sub": "f8b0676d-9b28-4eb6-82a2-12e21b77c8e3",
"typ": "Bearer",
"azp": "CCC",
"acr": "1",
"allowed-origins": [
"*"
],
"realm_access": {
"roles": [
"default-roles-YYY",
"offline_access",
"uma_authorization"
]
},
"resource_access": {
"account": {
"roles": [
"manage-account",
"manage-account-links",
"view-profile"
]
}
},
"scope": "profile good-service email groups",
"email_verified": false,
"clientId": "caravan",
"clientHost": "XX.XX.XX.XX",
"preferred_username": "service-account-caravan",
"clientAddress": "XX.XX.XX.XX"
}
But when I try to verify access with this API :
curl --location --request POST 'https://XXX/realms/YYY/protocol/openid-connect/token/introspect' \
--header 'Authorization: Bearer eyJhbGciOiJS.....' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'token=eyJhbGciOiJS.....'
it return error 401
"error": "invalid_request",
"error_description": "Authentication failed."
}
how can my access token can not work ?? Am I misundestanding something ?

Answer 1

You missed two items in body of introspect API.
You need to add the client_id and client_secret
Demo, using Keycloak v20.0.2 by curl from terminal.
And using jq for extract child field's value or pretty print.
#1 set configuration in environment variables.
CLIENT_ID=my-client
CLIENT_SECRET=d2IrqYfIcbjQuCqnzM8AoqFz0s9DBaJ0
REALM_NAME=my-realm
PORT=8180
#2 Get client token
CLIENT_TOKEN=$(curl --location --request POST 'http://localhost:'$PORT'/realms/'$REALM_NAME'/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=openid' \
--data-urlencode 'client_id=my-client' \
--data-urlencode 'client_secret='$CLIENT_SECRET | jq -r '.access_token')
echo $CLIENT_TOKEN
Results
$ CLIENT_TOKEN=$(curl --location --request POST 'http://localhost:'$PORT'/realms/'$REALM_NAME'/protocol/openid-connect/token' \
> --header 'Content-Type: application/x-www-form-urlencoded' \
> --data-urlencode 'grant_type=client_credentials' \
> --data-urlencode 'scope=openid' \
> --data-urlencode 'client_id=my-client' \
> --data-urlencode 'client_secret='$CLIENT_SECRET | jq -r '.access_token')
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2588 100 2479 100 109 268k 12111 --:--:-- --:--:-- --:--:-- 280k
$ echo $CLIENT_TOKEN
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJ3YW9QMDlKcXZMX2hCX1pleEh5M2hPVXFNZ2UzVnlGc3g4Tm9Na2N4RVM0In0.eyJleHAiOjE2NzMyOTYyNjksImlhdCI6MTY3MzI5NTk2OSwianRpIjoiZjYzNGQ3NTEtN2RlZi00MWY3LWJkZjQtMjkyMjRjOTYyMWFkIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MTgwL3JlYWxtcy9teS1yZWFsbSIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiIyNDlkNGI0OC03MGRiLTQzNjAtODBlMi03MzliZWY1M2JkNmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJteS1jbGllbnQiLCJhY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iLCJkZWZhdWx0LXJvbGVzLW15LXJlYWxtIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsibXktY2xpZW50Ijp7InJvbGVzIjpbInVtYV9wcm90ZWN0aW9uIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiY2xpZW50SG9zdCI6IjE3Mi4xNy4wLjEiLCJjbGllbnRJZCI6Im15LWNsaWVudCIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwicHJlZmVycmVkX3VzZXJuYW1lIjoic2VydmljZS1hY2NvdW50LW15LWNsaWVudCIsImNsaWVudEFkZHJlc3MiOiIxNzIuMTcuMC4xIn0.CSOlC4wmGRs95q71Gr-IjavtjUaq8mykSjcg6sXOLn_VQH2i_rlYb7eBOthyHSloZrrHbzLVWgOZ2Ah2jJmgqJ5CKXcfi4gSSbyOMll5dI5AGK8QMhVoHWIs_CD8KCfXR5ca8kfeZLdbabqusLl_D6Cqcg2tavPb8SLDEfVLnbija1ZaeBjI0jSuEIkf0sxCaYl-vrnHkvgExN3i5AgZzJ4uoOAAWuBPHjVdDX5pa_s6adi_PGKM2YQlVvWbirwSznWmAFnVhBRFW8ZuKum9BmUTcknT1K65DVMAthNp5zuBzkuMaCmWFuIzwpYtRzfIy66THFKdppDnXEyoo99_Jg
#3 Introspect that token
curl --location --request POST 'http://localhost:'$PORT'/realms/'$REALM_NAME'/protocol/openid-connect/token/introspect' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id='$CLIENT_ID \
--data-urlencode 'client_secret='$CLIENT_SECRET \
--data-urlencode 'token='$CLIENT_TOKEN | jq -r
Results
$ curl --location --request POST 'http://localhost:'$PORT'/realms/'$REALM_NAME'/protocol/openid-connect/token/introspect' \
> --header 'Content-Type: application/x-www-form-urlencoded' \
> --data-urlencode 'client_id='$CLIENT_ID \
> --data-urlencode 'client_secret='$CLIENT_SECRET \
> --data-urlencode 'token='$CLIENT_TOKEN | jq -r
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2094 100 715 100 1379 174k 336k --:--:-- --:--:-- --:--:-- 511k
{
"exp": 1673296269,
"iat": 1673295969,
"jti": "f634d751-7def-41f7-bdf4-29224c9621ad",
"iss": "http://localhost:8180/realms/my-realm",
"aud": "account",
"sub": "249d4b48-70db-4360-80e2-739bef53bd6e",
"typ": "Bearer",
"azp": "my-client",
"preferred_username": "service-account-my-client",
"email_verified": false,
"acr": "1",
"realm_access": {
"roles": [
"offline_access",
"uma_authorization",
"default-roles-my-realm"
]
},
"resource_access": {
"my-client": {
"roles": [
"uma_protection"
]
},
"account": {
"roles": [
"manage-account",
"manage-account-links",
"view-profile"
]
}
},
"scope": "openid profile email",
"clientHost": "172.17.0.1",
"clientId": "my-client",
"clientAddress": "172.17.0.1",
"client_id": "my-client",
"username": "service-account-my-client",
"active": true
}