gentics / gentics/mesh

keycloak is using jwt token, the JWTMeshAuthandler authenticates it but is not invoking the keycloakPlugin..

Open
#1,135 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
593
Forks
123
Avg merge
2d 18h
Merged PRs (30d)
4

Description

Dear colleagues,
at the moment i am facing a challenge here with your code. Our keycloak is issuing jwt token and they are validated by the
MeshJWTHandler which does not invoke any plugins for keycloak and no keycloak users gets created.

I see that only MeshOAUTH2Service is invoking such plugins - it never gets invoked when the authentication with mesjwthandler fails.

What can i do?

BTW, i have changed the gentics mesh algorithm from HS256 to RS256 according to your documentation - but it does not pick it up - because in jwtoptions is the algorithm "HS256" hard-coded.

public class JWTOptions {

private static final JsonObject EMPTY = new JsonObject(Collections.emptyMap());

private int leeway = 0;
private boolean ignoreExpiration;
private String algorithm = "HS256";
private JsonObject header = EMPTY;

## Gentics Mesh Version, operating system, or hardware.
- v1.7.1

## Operating System
- Linux
- MacOSX
- Windows
- Other, name?

## JVM
- Oracle JDK 1.8.0_100
- Open JDK 1.8.0_100

## Problem

## Reproducer

## Expected behaviour and actual behaviour

Contributor guide

Open the contributing guide

Research direction

Start by locating JWTOptions, MeshJWTHandler, MeshOAUTH2Service, and the Keycloak plugin code, then compare the JWT and OAuth authentication paths. Check how the configured algorithm and plugin invocation are handled; done means RS256 configuration is honored and the expected Keycloak user-creation flow works for JWT authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.