Fine-grained authorization with public client using keycloak - oauth-2.0

Question

From my understanding, a client (in our case SPA) will exchange an authorization_code for an access_token with the authorization server (keycloak).
This access token can then be sent to the Resource Server (in our case, Spring server), which then controls and grant access to the resources available.
A confidential client can customize these authorization to a deep level (using permissions, scope and policies). Whereas a public client only could use client scope. (Is there any difference between scope and client scope ?)
The difference between a public and a confidential client is that the public client can't be trusted to hold credentials. (Such as a client secret).
It still doesn't stop you from using any role mapping (afaik coarse-grained authz) whatsoever, therefore :
How come only coarse-grained authorization is available for a public client ?
How should I workaround that ? Configure my resource reserver as a keycloak client & somehow share the JWT securely ? While mapping the public's app roles to the resource server ?
Thanks !

Answer 1

Just define how Spring authorities should be mapped from JWT claims or introspected attributes.
In the following, I map authorities from Keycloak "roles" from "realm" and two different clients (one confidential and one public, but this makes absolutely no difference). Just open one of your JWT access-token in a tool like https://jwt.io or call introspection endpoint with a valid access-token to see attributes (and figure out where are roles, permissions, groups or whatever should be mapped to Spring authorities).
JWT decoder
You can configure a Converter<Jwt, AbstractAuthenticationToken>:
#Bean
public SecurityFilterChain filterChain(HttpSecurity http, Converter<Jwt, AbstractAuthenticationToken> authenticationConverter) {
http.oauth2ResourceServer().jwt().jwtAuthenticationConverter(authenticationConverter);
}
public interface Jwt2AuthoritiesConverter extends Converter<Jwt, Collection<? extends GrantedAuthority>> {
}
public interface Jwt2AuthenticationConverter extends Converter<Jwt, AbstractAuthenticationToken> {
}
#SuppressWarnings("unchecked")
#Bean
public Jwt2AuthoritiesConverter authoritiesConverter() {
return jwt -> {
final var realmAccess = (Map<String, Object>) jwt.getClaims().getOrDefault("realm_access", Map.of());
final var realmRoles = (Collection<String>) realmAccess.getOrDefault("roles", List.of());
final var resourceAccess = (Map<String, Object>) jwt.getClaims().getOrDefault("resource_access", Map.of());
// We assume here you have "spring-addons-confidential" and
// "spring-addons-public" clients configured with "client roles" mapper in
// Keycloak
final var confidentialClientAccess = (Map<String, Object>) resourceAccess
.getOrDefault("spring-addons-confidential", Map.of());
final var confidentialClientRoles = (Collection<String>) confidentialClientAccess.getOrDefault("roles",
List.of());
final var publicClientAccess = (Map<String, Object>) resourceAccess.getOrDefault("spring-addons-public",
Map.of());
final var publicClientRoles = (Collection<String>) publicClientAccess.getOrDefault("roles", List.of());
return Stream
.concat(realmRoles.stream(),
Stream.concat(confidentialClientRoles.stream(), publicClientRoles.stream()))
.map(SimpleGrantedAuthority::new).toList();
};
}
#Bean
public Jwt2AuthenticationConverter authenticationConverter(Converter<Jwt, Collection<? extends GrantedAuthority>> authoritiesConverter) {
return jwt -> new JwtAuthenticationToken(jwt, authoritiesConverter.convert(jwt));
}
Token introspection
Since spring-security 5.8, you can define an authentication converter for access-token introspection too:
#Bean
SecurityFilterChain filterChain(HttpSecurity http, OpaqueTokenAuthenticationConverter authenticationConverter) {
http.oauth2ResourceServer().opaqueToken().authenticationConverter(authenticationConverter);
}
#Bean
OpaqueTokenAuthenticationConverter authenticationConverter(
Converter<Map<String, Object>, Collection<? extends GrantedAuthority>> authoritiesConverter) {
return (String introspectedToken,
OAuth2AuthenticatedPrincipal authenticatedPrincipal) -> new BearerTokenAuthentication(
authenticatedPrincipal,
new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, introspectedToken,
authenticatedPrincipal.getAttribute(OAuth2TokenIntrospectionClaimNames.IAT),
authenticatedPrincipal.getAttribute(OAuth2TokenIntrospectionClaimNames.EXP)),
authoritiesConverter.convert(authenticatedPrincipal.getAttributes()));
}
public interface Attributes2AuthoritiesConverter extends Converter<Map<String, Object>, Collection<? extends GrantedAuthority>> { }
#SuppressWarnings("unchecked")
#Bean
public Attributes2AuthoritiesConverter authoritiesConverter() {
return attributes -> {
final var realmAccess = (Map<String, Object>) attributes.getOrDefault("realm_access", Map.of());
final var realmRoles = (Collection<String>) realmAccess.getOrDefault("roles", List.of());
final var resourceAccess = (Map<String, Object>) attributes.getOrDefault("resource_access", Map.of());
// We assume here you have "spring-addons-confidential" and
// "spring-addons-public" clients configured with "client roles" mapper in
// Keycloak
final var confidentialClientAccess = (Map<String, Object>) resourceAccess
.getOrDefault("spring-addons-confidential", Map.of());
final var confidentialClientRoles = (Collection<String>) confidentialClientAccess.getOrDefault("roles",
List.of());
final var publicClientAccess = (Map<String, Object>) resourceAccess.getOrDefault("spring-addons-public",
Map.of());
final var publicClientRoles = (Collection<String>) publicClientAccess.getOrDefault("roles", List.of());
return Stream
.concat(realmRoles.stream(),
Stream.concat(confidentialClientRoles.stream(), publicClientRoles.stream()))
.map(SimpleGrantedAuthority::new).toList();
};
}
Make things simple
I maintain spring-boot starters which are thin wrappers arround spring-boot-starter-oauth2-resource-server. It allows to configure most of resource-servers security from properties file: authorities mapping (with hand on prefix and case), off course, but also other usefull stuff like CORS, CSRF, public routes and session-management:
<dependency>
<groupId>com.c4-soft.springaddons</groupId>
<artifactId>spring-addons-webmvc-jwt-resource-server</artifactId>
<version>6.0.4</version>
</dependency>
#EnableMethodSecurity
public static class WebSecurityConfig { }
com.c4-soft.springaddons.security.issuers[0].location=https://localhost:8443/realms/master
com.c4-soft.springaddons.security.issuers[0].authorities.claims=realm_access.roles,ressource_access.some-client.roles
com.c4-soft.springaddons.security.cors[0].path=/some-api
And as a bonus, it comes with tools to ease your access-control unit & integration tests:
#Test
#WithMockJwtAuth(authorities = "ROLE_AUTHORIZED_PERSONNEL", claims = #OpenIdClaims(sub = "Ch4mpy"))
void greetMockCh4mpy() throws Exception {
mockMvc.perform(get("/greet")).andExpect(content().string("Hello Ch4mpy! You are granted with [ROLE_AUTHORIZED_PERSONNEL]."));
}
Refer to tutorials and samples for more details and declinations for
servlet or reactive apps
JWT decoding or token introspection
Spring default or custom Authentication implementations