Warm tip: This article is reproduced from serverfault.com, please click

Unable to validate the token from Keycloak

发布于 2020-01-20 10:56:55

I am trying to validate the token received from the keycloak. I have created TestClient as the client, TestRealm as the realm and "user" as the user. While validating the received token, I am hitting this endpoint- http://localhost:8080/auth/realms/TestRealm/protocol/openid-connect/userinfo.

In the response instead of receiving the actual user details, I am receiving this response everytime:

{
    "sub": "xxxx-xxxx-xxxx-xxxx-xxxxxx",
    "email_verified": false,
    "preferred_username": "service-account-testclient"
}

Can someone explain?

Questioner
Kshitiz Sharma
Viewed
0
Jan Garaj 2020-01-21 02:09:58

I wouldn't say that you are doing a token validation. Token validation requires token signature verification (against used realm public key usually).

You are just calling standard OIDC userinfo endpoint with token in the auth header and Keycloak must execute a token validation as part of request processing. Userinfo response depends on your Keycloak client configuration (mappers, scopes, ...).

So when you are getting userinfo response with http code 200, then token must be valid. But don't use userinfo for "token validation" - it will increase Keycloak load unnecessary, it is slow approach, userinfo endpoint is not designated for that, .... Do a offline, stateless, quick token signature verification. It should be a standard feature of all OIDC libraries.