{"id":68243,"date":"2020-09-04T15:54:57","date_gmt":"2020-09-04T15:54:57","guid":{"rendered":"https:\/\/www.baeldung.com\/?p=86616"},"modified":"2020-09-04T15:54:57","modified_gmt":"2020-09-04T15:54:57","slug":"custom-user-attributes-with-keycloak","status":"publish","type":"post","link":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/2020\/09\/04\/custom-user-attributes-with-keycloak\/","title":{"rendered":"Custom User Attributes with Keycloak"},"content":{"rendered":"

<\/p>\n

1. Overview<\/h2>\n
<\/div>\n

Keycloak<\/a> is a third-party authorization server that manages users of our web or mobile applications.<\/p>\n

It offers some default attributes, such as first name, last name, and email to be stored for any given user. But many times, these are not enough, and we might need to add some extra user attributes specific to our application.<\/p>\n

In this tutorial, we’ll see how we can add custom user attributes to our Keycloak authorization server and access them in a Spring-based backend<\/strong>.<\/p>\n

First, we’ll see this for a standalone<\/a> Keycloak server, and then for an embedded<\/a> one.<\/p>\n

2. Standalone Server<\/h2>\n
<\/div>\n

2.1. Adding Custom User Attributes<\/h3>\n
<\/div>\n

The first step here is to go to Keycloak’s admin console. For that, we’ll need to start the server by running this command from our Keycloak distribution’s bin<\/em> folder:<\/p>\n

.\/standalone.sh -Djboss.socket.binding.port-offset=100<\/code><\/pre>\n
Then we need to go to the admin console<\/a> and key-in the initial1<\/em>\/zaq1!QAZ <\/em>credentials.<\/p>\n
Next, we’ll click on Users<\/em> under the Manage<\/em> tab and then View all users<\/em>:<\/p>\n
\"\"<\/a><\/p>\n
Here we can see the user we’d added previously<\/a>:\u00a0user1<\/em>.<\/p>\n
Now let’s click on its ID<\/em> and go to the Attributes<\/em> tab to add a new one, DOB<\/em> for date of birth:<\/p>\n
\"\"<\/a><\/p>\n
After clicking Save<\/em>, the custom attribute gets added to the user’s information.<\/p>\n
Next, we need to add a mapping for this attribute as a custom claim so that it’s available in the JSON payload for the user’s token.<\/p>\n
For that, we need to go to our application’s client on the admin console. Recall that earlier we’d created a client, login-app<\/em><\/a>:<\/p>\n
\"\"<\/a><\/p>\n
Now, let’s click on it and go to its Mappers<\/em> tab to create a new mapping:<\/p>\n
\"\"<\/a><\/p>\n
First, we’ll select the Mapper Type<\/em> as User Attribute<\/em> and then set Name<\/em>, User Attribute<\/em>, and Token Claim Name<\/em> as DOB<\/em>. Claim JSON Type<\/em> should be set as String<\/em>.<\/p>\n
On clicking Save<\/em>, our mapping is ready. So now, we’re equipped from the Keycloak end to receive DOB<\/em> as a custom user attribute.<\/p>\n
In the next section, we’ll see how to access it via an API call<\/strong>.<\/p>\n
2.2. Accessing Custom User Attributes<\/h3>\n
<\/div>\n
Building on top of our Spring Boot application<\/a>, let’s add a new REST controller to get the user attribute we added:<\/p>\n
@Controller\r\npublic class CustomUserAttrController {\r\n    @GetMapping(path = \"\/users\")\r\n    public String getUserInfo(Model model) {\r\n        KeycloakAuthenticationToken authentication = (KeycloakAuthenticationToken) \r\n          SecurityContextHolder.getContext().getAuthentication();\r\n        \r\n        Principal principal = (Principal) authentication.getPrincipal();        \r\n        String dob=\"\";\r\n        \r\n        if (principal instanceof KeycloakPrincipal) {\r\n            KeycloakPrincipal kPrincipal = (KeycloakPrincipal) principal;\r\n            IDToken token = kPrincipal.getKeycloakSecurityContext().getIdToken();\r\n            Map<String, Object> customClaims = token.getOtherClaims();\r\n            if (customClaims.containsKey(\"DOB\")) {\r\n                dob = String.valueOf(customClaims.get(\"DOB\"));\r\n            }\r\n        }\r\n        \r\n        model.addAttribute(\"username\", principal.getName());\r\n        model.addAttribute(\"dob\", dob);\r\n        return \"userInfo\";\r\n    }\r\n}\r\n<\/code><\/pre>\n
As we can see, here we first obtained the KeycloakAuthenticationToken<\/em> from the security context and then extracted the Principal<\/em> from it. After casting it as a KeycloakPrincipal<\/em>, we obtained its IDToken<\/em>.<\/p>\n
DOB<\/em> can then be extracted from this IDToken<\/em>‘s OtherClaims<\/em>.<\/p>\n
Here’s the template, named\u00a0userInfo.html,<\/em> that we’ll use to display this information:<\/p>\n
<div id=\"container\">\r\n    <h1>Hello, <span th:text=\"${username}\">--name--<\/span>.<\/h1>\r\n    <h3>Your Date of Birth as per our records is <span th:text=\"${dob}\"\/>.<\/h3>\r\n<\/div><\/code><\/pre>\n
2.3. Testing<\/h3>\n
<\/div>\n
On starting the Boot application, we should navigate to http:\/\/localhost:8081\/users<\/a>. <\/em>We’ll first be asked to enter credentials.<\/p>\n
After entering user1<\/em>‘s credentials, we should see this page:<\/p>\n
\"\"<\/a><\/p>\n
3. Embedded Server<\/h2>\n
<\/div>\n
Now let’s see how to achieve the same thing on an embedded Keycloak instance.<\/p>\n
3.1. Adding Custom User Attributes<\/h3>\n
<\/div>\n
Basically, we need to do the same steps here, only that we’ll need to save them as pre-configurations<\/a> in our realm definition file, baeldung-realm.json<\/em><\/strong>.<\/p>\n
To add the attribute DOB<\/em> to our user john@test.com<\/em>, first, we need to configure its attributes:<\/p>\n
\"attributes\" : {\r\n    \"DOB\" : \"1984-07-01\"\r\n},<\/code><\/pre>\n
Then add the protocol mapper for DOB<\/em>:<\/p>\n
\"protocolMappers\": [\r\n    {\r\n    \"id\": \"c5237a00-d3ea-4e87-9caf-5146b02d1a15\",\r\n    \"name\": \"DOB\",\r\n    \"protocol\": \"openid-connect\",\r\n    \"protocolMapper\": \"oidc-usermodel-attribute-mapper\",\r\n    \"consentRequired\": false,\r\n    \"config\": {\r\n        \"userinfo.token.claim\": \"true\",\r\n        \"user.attribute\": \"DOB\",\r\n        \"id.token.claim\": \"true\",\r\n        \"access.token.claim\": \"true\",\r\n        \"claim.name\": \"DOB\",\r\n        \"jsonType.label\": \"String\"\r\n        }\r\n    }\r\n]<\/code><\/pre>\n
That’s all we need here.<\/p>\n
Now that we’ve seen the authorization server part of adding a custom user attribute, it’s time to look at how the resource server<\/a> can access the user’s DOB<\/em>.<\/p>\n
3.2. Accessing Custom User Attributes<\/h3>\n
<\/div>\n
On the resource server-side, the custom attributes will simply be available to us as claim values in the AuthenticationPrincipal<\/em><\/a>.<\/p>\n
Let’s code an API for it:<\/p>\n
@RestController\r\npublic class CustomUserAttrController {\r\n    @GetMapping(\"\/user\/info\/custom\")\r\n    public Map<String, Object> getUserInfo(@AuthenticationPrincipal Jwt principal) {\r\n        return Collections.singletonMap(\"DOB\", principal.getClaimAsString(\"DOB\"));\r\n    }\r\n}<\/code><\/pre>\n
3.3. Testing<\/h3>\n
<\/div>\n
Now let’s test it using JUnit.<\/p>\n
We’ll first need to obtain an access token and then call the \/user\/info\/custom<\/em> API endpoint on the resource server:<\/p>\n
@Test\r\npublic void givenUserWithReadScope_whenGetUserInformationResource_thenSuccess() {\r\n    String accessToken = obtainAccessToken(\"read\");\r\n    Response response = RestAssured.given()\r\n      .header(HttpHeaders.AUTHORIZATION, \"Bearer \" + accessToken)\r\n      .get(userInfoResourceUrl);\r\n    assertThat(response.as(Map.class)).containsEntry(\"DOB\", \"1984-07-01\");\r\n}<\/code><\/pre>\n
As we can see, here we verified that we’re getting the same DOB<\/em> value as we added in the user’s attributes<\/strong>.<\/p>\n
4. Conclusion<\/h2>\n
<\/div>\n
In this tutorial, we learned how to add extra attributes to a user in Keycloak.
\n
\n<\/strong><\/p>\n
We saw this for both a standalone and an embedded instance. We also saw how to access these custom claims in a REST API on the backend in both scenarios.<\/p>\n
As always, the source code is available over on GitHub. For the standalone server, it’s on the tutorials GitHub<\/a>, and for the embedded instance, on the OAuth GitHub<\/a>.<\/p>\n
The post Custom User Attributes with Keycloak<\/a> first appeared on Baeldung<\/a>.<\/p>\n
\"\"<\/p>\n
<\/a> <\/a> <\/a> <\/a> <\/a> <\/a> <\/a> <\/a> <\/div>\n\n
\\\"IT\u96fb\u8166\u88dc\u7fd2
\u7acb\u523b\u8a3b\u518a\u53ca\u5831\u540d\u96fb\u8166\u88dc\u7fd2\u8ab2\u7a0b\u5427!<\/figcaption><\/figure>\r\n<\/br>Find A Teacher Form:\r\n<\/br>https:\/\/docs.google.com\/forms\/d\/1vREBnX5n262umf4wU5U2pyTwvk9O-JrAgblA-wH9GFQ\/viewform?edit_requested=true#responses\r\n<\/br><\/br>Email:\r\n<\/br>public1989two@gmail.com






\r\nwww.itsec.hk<\/a>
\r\nwww.itsec.vip<\/a>
\r\nwww.itseceu.uk<\/a>
<\/p>","protected":false},"excerpt":{"rendered":"
Learn how to add extra attributes to a user in Keycloak.<\/p>\n
The post Custom User Attributes with Keycloak<\/a> first appeared on Baeldung<\/a>.<\/p>\n
<\/a> <\/a> <\/a> <\/a> <\/a> <\/a> <\/a> <\/a> <\/div>\n<\/div>","protected":false},"author":770,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"slim_seo":{"title":"Custom User Attributes with Keycloak - ITTeacherITFreelance.hk","description":"Learn how to add extra attributes to a user in Keycloak. The post Custom User Attributes with Keycloak first appeared on Baeldung .        "},"footnotes":""},"categories":[6],"tags":[],"_links":{"self":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/68243"}],"collection":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/users\/770"}],"replies":[{"embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/comments?post=68243"}],"version-history":[{"count":9,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/68243\/revisions"}],"predecessor-version":[{"id":72479,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/posts\/68243\/revisions\/72479"}],"wp:attachment":[{"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/media?parent=68243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/categories?post=68243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itteacheritfreelance.hk\/wordpress\/index.php\/wp-json\/wp\/v2\/tags?post=68243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}