add claims to access token keycloak

Question

Below is my use case: I need to add a claim to the access token so that i can use it during policy evaluation on my resource. My policy is a javascript based policy and it gets access only to reserved and custom attributes of the logged in user. I have used the below api to push claims:

curl -X POST \
  http://localhost:8082/auth/realms/cms-non-prod/protocol/openid-connect/token \
  -H 'Authorization: Bearer eyJhbGciOiJSXXXXXXXXXXXXXXXX' \
  -H 'Cache-Control: no-cache' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Postman-Token: ac020c2b-9efb-4817-81ea-61895c8775a7' \
  -d 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Auma-ticket&claim_token=ewoiaW5zdGl0dXRpb25JZCI6WyJEQ0IiXQp9& claim_token_format=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Ajwt&client_id=indra-bff \
&client_Secret=5760582d-74ff-496c-a6c2-2530ddde6408&audience=indra-bff'

It adds the claim but it adds in to authorization--> Permissions-->Resources. How do i read this if i have a JS based policy. Any pointers on this will help. Below is the token i get when i hit above url:

{
  "jti": "4c00f1a4-8038-4c45-820d-23a9c9ab6d42",
  "exp": 1580733917,
  "nbf": 0,
  "iat": 1580730317,
  "iss": "http://localhost:8082/auth/realms/cms-non-prod",
  "aud": "indra-bff",
  "sub": "9ab2fc80-3a5c-426d-ae78-56de01d214df",
  "typ": "Bearer",
  "azp": "indra-bff",
  "auth_time": 0,
  "session_state": "2ab35757-d09d-4d52-946b-f519a1338abf",
  "acr": "1",
  "realm_access": {
    "roles": [
      "PR_DCB_RECON_ASSOCIATE",
      "PR_YBL_RECON_ASSOCIATE",
      "offline_access",
      "uma_authorization",
      "PR_DCB_RECON_MGR"
    ]
  },
  "resource_access": {
    "indra-bff": {
      "roles": [
        "uma_protection"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "authorization": {
    "permissions": [
      {
        "claims": {
          "institutionId": [
            "DCB"
          ]
        },
        "rsid": "17fdf554-8643-4741-b9a4-13309e830b6f",
        "rsname": "Default Resource"
      },
      {
        "scopes": [
          "DELETE",
          "POST",
          "GET",
          "PUT",
          "PATCH"
        ],
        "claims": {
          "institutionId": [
            "DCB"
          ]
        },
        "rsid": "56cabb7c-76a1-4260-bd9f-d5494458c6bf",
        "rsname": "adjustment"
      },
      {
        "scopes": [
          "DELETE",
          "POST",
          "GET",
          "PUT",
          "PATCH"
        ],
        "claims": {
          "institutionId": [
            "DCB"
          ]
        },
        "rsid": "70297346-8010-4c1d-91b1-9bc22edd3061",
        "rsname": "chargeback"
      }
    ]
  },
  "scope": "profile email",
  "institution": "UNKNOWN",
  "email_verified": false,
  "preferred_username": "siva",
  "email": "siva@goniyo.com"
}

Thanks for your help. Cheers,

score 20 · Answer 1 · edited Sep 18 '20 at 07:47

20

This method if for the UI. In your realm, select your client. For that client, go the 'Mappers' option and then click on 'Create'. You can have the mapper type as 'User Attribute' and select the option(s) to add the attribute to ID token, access token and userinfo. The attribute added here should exist on the user.

edited Sep 18 '20 at 07:47

helvete

2,455
13
33
37

answered Sep 17 '20 at 11:44

Amanpreet Singh

329
2
5

7

In newer keycloak versions (right now 20) the click path is: client -> (pick yours) -> client scopes -> pick the first (dedicated client scope) -> add mappers – Lu_kors Jan 27 '23 at 14:17

score 1 · Answer 2 · answered Feb 04 '20 at 06:01

1

Check if you can get from the resource

var permission = $evaluation.getPermission();
var resource = permission.getResource();

answered Feb 04 '20 at 06:01

ravthiru

8,878
2
43
52

score 0 · Answer 3 · answered Apr 23 '21 at 08:38

Claims in your claim token can be reached through the Permission handle.

Considering your claim_token contains the following information:

{
   "institutionId":["DCB"]
}

You can use this Javascript in your policy to fetch the string value "DCB":

$evaluation.getPermission().getClaims()["institutionId"].toArray()[0]

Source: Keycloak JavaDocs: ResourcePermission

add claims to access token keycloak

3 Answers3

Linked