Keycloak securityContext is null

Question

I am trying to fetch the user details of a logged in user :

I am passing the access token collected from :

https://localhost:1099/auth/realms/myrealm/protocol/openid-connect/token

while calling this endpoint :

import org.keycloak.KeycloakSecurityContext;
import org.keycloak.representations.AccessToken;
import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
import java.util.Collections;
import java.util.Map;

@RestController
public class userDetails {

    @GetMapping(value = "/myresources", produces = MediaType.APPLICATION_JSON_VALUE)
    public String handleUserInfoRequest(HttpServletRequest request) {
        System.out.println("Using HttpServletRequest to inspect authentication...");

        // Get the HttpSession from the request
        HttpSession session = request.getSession();

        // Get the Keycloak security context from the session attribute
        KeycloakSecurityContext securityContext = (KeycloakSecurityContext) session.getAttribute(KeycloakSecurityContext.class.getName());

        if (securityContext != null) {
            AccessToken token = securityContext.getToken();

            // Extract details from the token
            String userId = token.getId();
            String userName = token.getPreferredUsername();

            // Print security context details
            String securityContextDetails = "User ID: " + userId + "\n" +
                                           "Username: " + userName;

            System.out.println("Security Context Details:\n" + securityContextDetails);

            // Return a response
            return securityContextDetails;
        } else {
            return "No Keycloak Security Context found";
        }
    }


}

I have also tried to get the security context from httpServletRequest for secured users using this instead of the session as done above :

  // Get the Keycloak security context from the request attribute
        KeycloakSecurityContext securityContext = (KeycloakSecurityContext) request.getAttribute(KeycloakSecurityContext.class.getName());

However, I am getting "No Keycloak Security Context found" or security context is null, principal is null. How can I get the user details i.e. "preferrred_username" from the access token. Iam not using spring security and I am using embedded springboot keycloak version 21.0.0 . Thanks in advance for all the inputs.

Answer 1

Keycloak adapter for spring was deprecated long ago. See this other answer for alternatives.

Once your security conf is fixed, you should have an Authentication instance in the security context. The type of this Authentication will depend on the request being

• anonymous => AbstractAuthenticationToken
• authorized with a session on an OAuth2 client with oauth2Login => OAuth2AuthenticationToken having an OAuth2User as principal (in case of OIDC authorization servers like Keycloak, this interface is further specialized to OidcUser)
• authorized with an access token on an OAuth2 resource server => the default Authentication depends on the conf (and can be easily replaced with a custom implementation like Keycloak adapters were doing):
  • JwtAuthenticationToken when a JWT decoder is used
  • BearerTokenAuthentication when introspection is used (usually with "opaque" tokens, even if you can introspect a JWT)

The easiest way access this Authentication is with "magic" parameter for your controller method:

@GetMapping("/me")
public Map<String, Object> getMe(Authentication auth) {
    // authorized request to a resource server with JWT decoder
    if (auth instance of JwtAuthenticationToken jwt) {
        return jwt.getTokenAttributes();
    }
    // authorized request to a resource server with introspection
    if (auth instance of BearerTokenAuthentication bearerToken) {
        return bearerToken.getTokenAttributes();
    }
    // authorized request to an OpenID client 
    if (auth instanceof OAuth2AuthenticationToken oauth && oauth.getPrincipal() instanceof OAuth2AuthenticatedPrincipal user) {
        return user.getAttributes();
    }
    // most probably an unauthorized request (anonymous)
    return Map.of();
}

Of course, you can also use the SecurityContextHolder.getContext().getAuthentication() static accessor, but it is probably not as convenient.