0

I have a Spring Boot-application with a public REST-API. The user authentication is handled by Keycloak. Users can use the API to submit jobs, which are then executed periodically as a Spring Batch. Some of these jobs require the user to be notified via eMail after completion.

The application currently does not store any user-related information, except the ID of the user, who submitted the job. My problem is now, that I need the eMail-address belonging to that User-ID to send the job-completion notification. The JWT passed to the API, which contains this information, can't be used at this time, since the job is executed asynchronous in the batch-context.

I came up with 2 possible solutions so far, which both have their own drawbacks in my opinion:

solution 1: extracting the required information from the JWT and persist them in the application's database for later use

drawbacks:

  • the application should not be concerned with storing user-information; it also shouldn't duplicate data controlled by other applications
  • the user might change its eMail-address in the primary user-database, without getting noticed by my application

solution 2: requesting user-details as needed by using Keycloak-APIs.

This looks theoretically like a good approach to me. The suggested solutions on SO utilize the Keycloak Admin-API (endpoint /auth/admin/realms/{realm}/users/{user-id}) to fetch user-details. This requires the application to be configured as a "confidential client" with own client-credentials and an enabled service account. What bothers me here: It appears a bit strange to me, that a regular application without any special privileges uses an Admin-API. Also, the users-endpoint is not restricted to users, which have previously given consent to access their data.

Is there a good way to solve this problem?

mrlc
  • 1
  • 1

1 Answers1

0

If job requires an e-mail for its completion, why doesn't it request it as start parameter and just keep it in memory?

This is how I would proceed:

  • @Controller extracts e-mail from ID token on the end-point from which the user triggers job start
  • user e-mail is provided among other parameters to the job
  • job completes sending the e-mail
  • e-mail is lost, with other job resources
ch4mp
  • 6,622
  • 6
  • 29
  • 49
  • Thank you for your idea. Unfortunately, this won't solve the problem: The job will be executed periodically (usually once a day), until the user stops it. For this particular task it is expected, that a started job will be running for several years. – mrlc Dec 19 '20 at 14:37
  • Then, you might have no other choice than persist user subject (not e-mail) and query authorization-server (Keycloak in your case) user-info endpoint using "client credentials" flow to retrieve user e-mail each time a job terminates. Don't store the e-mail because it could change. Subject is permanent. – ch4mp Dec 21 '20 at 18:27