Package com.vaadin.flow.spring.security

Class KeycloakOidcUserMapper

java.lang.Object
com.vaadin.flow.spring.security.KeycloakOidcUserMapper
All Implemented Interfaces:
org.springframework.core.convert.converter.Converter<org.springframework.security.oauth2.client.oidc.userinfo.OidcUserSource,org.springframework.security.oauth2.core.oidc.user.OidcUser>
public class KeycloakOidcUserMapper extends Object implements org.springframework.core.convert.converter.Converter<org.springframework.security.oauth2.client.oidc.userinfo.OidcUserSource,org.springframework.security.oauth2.core.oidc.user.OidcUser>
Maps Keycloak realm and client roles to Spring Security granted authorities.

Keycloak puts the roles of a user into the access token rather than into the ID token, so they are not part of the OidcUser that OidcUserService builds by default. This converter decodes the access token and adds

  • the realm roles from the realm_access claim,
  • the roles that the resource_access claim grants for the client id of the current client registration, and
  • the scopes of the access token, prefixed with SCOPE_.
Realm and client roles both become role authorities, using the role prefix of the application (ROLE_ unless a GrantedAuthorityDefaults bean says otherwise), so that @RolesAllowed("admin") and hasRole("admin") match a Keycloak role named admin. Roles that resource_access grants for other clients are ignored.

An access token that is not a JWT, or that this application is not allowed to decode, is not an error: the user is mapped without any role authorities, as the default OidcUserService would do.

The recommended way to use this converter is VaadinSecurityConfigurer.keycloakRoleMapping(), which installs it for a single security filter chain. Applications that build their own OidcUserService can install it directly: 

 
 var oidcUserService = new OidcUserService();
 oidcUserService.setOidcUserConverter(new KeycloakOidcUserMapper());
Since:
25.4
Author:
Vaadin Ltd

  • Constructor Summary

    Constructors
    Constructor
    Description
    KeycloakOidcUserMapper()
    Creates a mapper that prefixes roles with ROLE_.
    KeycloakOidcUserMapper(String rolePrefix)
    Creates a mapper that prefixes roles with the given prefix.

  • Method Summary

    Modifier and Type
    Method
    Description
    org.springframework.security.oauth2.core.oidc.user.OidcUser
    convert(org.springframework.security.oauth2.client.oidc.userinfo.OidcUserSource userSource)
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface org.springframework.core.convert.converter.Converter

    andThen

  • Constructor Details

    • KeycloakOidcUserMapper

      public KeycloakOidcUserMapper()
      Creates a mapper that prefixes roles with ROLE_.

    • KeycloakOidcUserMapper

      public KeycloakOidcUserMapper(String rolePrefix)
      Creates a mapper that prefixes roles with the given prefix.
      Parameters:
      rolePrefix - the prefix to add to a Keycloak role name, or null to use ROLE_

  • Method Details

    • convert

      public org.springframework.security.oauth2.core.oidc.user.OidcUser convert(org.springframework.security.oauth2.client.oidc.userinfo.OidcUserSource userSource)
      Specified by:
      convert in interface org.springframework.core.convert.converter.Converter<org.springframework.security.oauth2.client.oidc.userinfo.OidcUserSource,org.springframework.security.oauth2.core.oidc.user.OidcUser>