I have a problem with keycloak and oauth2 identification.
I use client_credentials grant type to request an access_token :
curl --location --request POST 'https://XXX/realms/YYY/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=CCC' \
--data-urlencode 'client_secret=6yqR3IEE...' \
--data-urlencode 'grant_type=client_credentials'
{
"access_token": "eyJhbGciOiJS.....",
"expires_in": 300,
"refresh_expires_in": 0,
"token_type": "Bearer",
"not-before-policy": 0,
"scope": "profile good-service email groups"
}
Seems ok. and verification on jwt.io confirm.
{
"exp": 1673290210,
"iat": 1673289910,
"jti": "b948569a-9597-4e1d-aab8-b95a24550965",
"iss": "https://XXX/realms/YYY",
"aud": "account",
"sub": "f8b0676d-9b28-4eb6-82a2-12e21b77c8e3",
"typ": "Bearer",
"azp": "CCC",
"acr": "1",
"allowed-origins": [
"*"
],
"realm_access": {
"roles": [
"default-roles-YYY",
"offline_access",
"uma_authorization"
]
},
"resource_access": {
"account": {
"roles": [
"manage-account",
"manage-account-links",
"view-profile"
]
}
},
"scope": "profile good-service email groups",
"email_verified": false,
"clientId": "caravan",
"clientHost": "XX.XX.XX.XX",
"preferred_username": "service-account-caravan",
"clientAddress": "XX.XX.XX.XX"
}
But when I try to verify access with this API :
curl --location --request POST 'https://XXX/realms/YYY/protocol/openid-connect/token/introspect' \
--header 'Authorization: Bearer eyJhbGciOiJS.....' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'token=eyJhbGciOiJS.....'
it return error 401
"error": "invalid_request",
"error_description": "Authentication failed."
}
how can my access token can not work ?? Am I misundestanding something ?
You missed two items in body of introspect API.
You need to add the client_id and client_secret
Demo, using Keycloak v20.0.2 by curl from terminal.
And using jq for extract child field's value or pretty print.
#1 set configuration in environment variables.
CLIENT_ID=my-client
CLIENT_SECRET=d2IrqYfIcbjQuCqnzM8AoqFz0s9DBaJ0
REALM_NAME=my-realm
PORT=8180
#2 Get client token
CLIENT_TOKEN=$(curl --location --request POST 'http://localhost:'$PORT'/realms/'$REALM_NAME'/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=openid' \
--data-urlencode 'client_id=my-client' \
--data-urlencode 'client_secret='$CLIENT_SECRET | jq -r '.access_token')
echo $CLIENT_TOKEN
Results
$ CLIENT_TOKEN=$(curl --location --request POST 'http://localhost:'$PORT'/realms/'$REALM_NAME'/protocol/openid-connect/token' \
> --header 'Content-Type: application/x-www-form-urlencoded' \
> --data-urlencode 'grant_type=client_credentials' \
> --data-urlencode 'scope=openid' \
> --data-urlencode 'client_id=my-client' \
> --data-urlencode 'client_secret='$CLIENT_SECRET | jq -r '.access_token')
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2588 100 2479 100 109 268k 12111 --:--:-- --:--:-- --:--:-- 280k
$ echo $CLIENT_TOKEN
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJ3YW9QMDlKcXZMX2hCX1pleEh5M2hPVXFNZ2UzVnlGc3g4Tm9Na2N4RVM0In0.eyJleHAiOjE2NzMyOTYyNjksImlhdCI6MTY3MzI5NTk2OSwianRpIjoiZjYzNGQ3NTEtN2RlZi00MWY3LWJkZjQtMjkyMjRjOTYyMWFkIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MTgwL3JlYWxtcy9teS1yZWFsbSIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiIyNDlkNGI0OC03MGRiLTQzNjAtODBlMi03MzliZWY1M2JkNmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJteS1jbGllbnQiLCJhY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iLCJkZWZhdWx0LXJvbGVzLW15LXJlYWxtIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsibXktY2xpZW50Ijp7InJvbGVzIjpbInVtYV9wcm90ZWN0aW9uIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiY2xpZW50SG9zdCI6IjE3Mi4xNy4wLjEiLCJjbGllbnRJZCI6Im15LWNsaWVudCIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwicHJlZmVycmVkX3VzZXJuYW1lIjoic2VydmljZS1hY2NvdW50LW15LWNsaWVudCIsImNsaWVudEFkZHJlc3MiOiIxNzIuMTcuMC4xIn0.CSOlC4wmGRs95q71Gr-IjavtjUaq8mykSjcg6sXOLn_VQH2i_rlYb7eBOthyHSloZrrHbzLVWgOZ2Ah2jJmgqJ5CKXcfi4gSSbyOMll5dI5AGK8QMhVoHWIs_CD8KCfXR5ca8kfeZLdbabqusLl_D6Cqcg2tavPb8SLDEfVLnbija1ZaeBjI0jSuEIkf0sxCaYl-vrnHkvgExN3i5AgZzJ4uoOAAWuBPHjVdDX5pa_s6adi_PGKM2YQlVvWbirwSznWmAFnVhBRFW8ZuKum9BmUTcknT1K65DVMAthNp5zuBzkuMaCmWFuIzwpYtRzfIy66THFKdppDnXEyoo99_Jg
#3 Introspect that token
curl --location --request POST 'http://localhost:'$PORT'/realms/'$REALM_NAME'/protocol/openid-connect/token/introspect' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id='$CLIENT_ID \
--data-urlencode 'client_secret='$CLIENT_SECRET \
--data-urlencode 'token='$CLIENT_TOKEN | jq -r
Results
$ curl --location --request POST 'http://localhost:'$PORT'/realms/'$REALM_NAME'/protocol/openid-connect/token/introspect' \
> --header 'Content-Type: application/x-www-form-urlencoded' \
> --data-urlencode 'client_id='$CLIENT_ID \
> --data-urlencode 'client_secret='$CLIENT_SECRET \
> --data-urlencode 'token='$CLIENT_TOKEN | jq -r
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2094 100 715 100 1379 174k 336k --:--:-- --:--:-- --:--:-- 511k
{
"exp": 1673296269,
"iat": 1673295969,
"jti": "f634d751-7def-41f7-bdf4-29224c9621ad",
"iss": "http://localhost:8180/realms/my-realm",
"aud": "account",
"sub": "249d4b48-70db-4360-80e2-739bef53bd6e",
"typ": "Bearer",
"azp": "my-client",
"preferred_username": "service-account-my-client",
"email_verified": false,
"acr": "1",
"realm_access": {
"roles": [
"offline_access",
"uma_authorization",
"default-roles-my-realm"
]
},
"resource_access": {
"my-client": {
"roles": [
"uma_protection"
]
},
"account": {
"roles": [
"manage-account",
"manage-account-links",
"view-profile"
]
}
},
"scope": "openid profile email",
"clientHost": "172.17.0.1",
"clientId": "my-client",
"clientAddress": "172.17.0.1",
"client_id": "my-client",
"username": "service-account-my-client",
"active": true
}
I'm using groovy file with Jenkins to send a curl PUT request. I need to hide the --data in the request, but everytime I run the pipeline it shows the data.... I've tried with --silent and --output /dev/null , but the data still shows in the Jenkins Console Output.
Curl Request
String data = """{
"name": "$secretName",
"Description": "$secretName",
"value": "$secretValue"
}"""
sh """
curl --request PUT \
--silent \
--output /dev/null \
--insecure \
--location \
--url $host \
--header 'accept: application/json' \
--header "Authorization: Basic $API_KEY" \
--header 'content-type: application/json' \
--data '${data}'
"""
}
}
What I see in Jenkins console is:
curl --request PUT --silent --output /dev/null --insecure --location --url hostname --header accept: application/json --header Authorization: Basic **** --header content-type: application/json --data {
"name": "MY_ACTUAL_VALUE",
"Description": "MY_ACTUAL_VALUE",
"value": "MY_ACTUAL_VALUE" }
How can I hide this part:
--data {
"name": "MY_ACTUAL_VALUE",
"Description": "MY_ACTUAL_VALUE",
"value": "MY_ACTUAL_VALUE" }
If you store $secretName as a credential, Jenkins will automatically hide it for in the console output.
Best regards.
Trying to use the reminders.app to post reminders via curl.
Getting the following error
{"ok":false,"error":"internal_error","warning":"missing_charset","response_metadata":{"warnings":["missing_charset"]}}
curl -X POST -H 'Authorization: Bearer secretsxxxxxxxxxxxxx' -H 'Content-type: application/json' --data \
'{
"ok": true,
"reminder": {
"text": "eat a banana",
"recurring": false,
"time": 1602288000
}
}' https://slack.com/api/reminders.add
You need to change the following line https://slack.com/api/reminders.add to https://slack.com/api/reminders.add?. Include the question mark at the end.
So your code should be:
curl -X POST -H 'Authorization: Bearer secretsxxxxxxxxxxxxx' \
-H "Content-type: application/json" \
--data '{"text": "I hope you eat your banana","time":1581447960}' \
https://slack.com/api/reminders.add
I am using curl command :
curl -X POST --user "apikey:xxx" \
--header "Content-Type: application/json" \
--header "Accept: application/json" \
--data-binary #profile.json \
"https://gateway-fra.watsonplatform.net/personality-insights/api"
and IBM is giving me response:
x{"code":404,"sub_code":"S00004","error":"Not Found"}%
anyone has idea why?
this is my .json file
https://watson-developer-cloud.github.io/doc-tutorial-downloads/personality-insights/profile.json
Try using the following curl command:
curl -X POST --user "apikey:xxxxxxxx" --header "Content-Type: application/json" --header "Accept: application/json" --data-binary #profile.json "https://gateway-fra.watsonplatform.net/personality-insights/api/v3/profile?version=2017-10-13&consumption_preferences=true&raw_scores=true"
Replace xxxxxxxx with your apikey. Please avoid using real apikey in public in the future. Anyone can use your key. I have edited the question to hide it.
Please follow the API reference for Personality Insights for more info.
Wondering how I would make this into an Alamofire Parameter.
curl -X GET \
-H "X-Parse-Application-Id: myAppId" \
-H "X-Parse-REST-API-Key: ${REST_API_KEY}" \
-G \
--data-urlencode 'where={"post":{"$inQuery":{"where":{"image":{"$exists":true}},"className":"Post"}}}' \
https://YOUR.PARSE-SERVER.HERE/1/classes/Comment
The part that's confusing is the --data-urlencode
Here's what I got so far:
let params: Parameters = [
"where": ["post": ["$inQuery" : "where": ]],
]
I'm stuck, do I keep nesting Parameters?