403 Forbidden while accessing Leycloak rest API with a valid user credentials

Question

I have set up a Keycloak server and a user named 'sample' is given permissions to access the rest ADMIN APIs, I granted permissions to the relevant realm and client_id. And I'm able to access the rest APIs using the postman service using this user credentials 'sample/sample'.

so through Angular application, I was trying to access the API that fetches the roles in a specific realm. since not all the login user will have the rest admin access, I'm using the user credentials(sample/sample) that have the access to admin API, but when I try to access the API, the APIs are forbidden,

 this.getKeycloakAccessToken().subscribe((Tokres:any)=>{
      console.log('accessToken: ', Tokres.body.access_token);
      if(Tokres && Tokres.status === 200 && Tokres.body.access_token){
        this.getKeycloakRoles(Tokres.body.access_token).subscribe((roleRes:any)=>{
          console.log(roleRes);
        },(roleErr:any)=>{
          console.log('error while fetching roles..');
          console.log(roleErr);
        })
      }
    },(tokErr:any)=>{
      console.log('error while accessing keycloak token...');
      console.log(tokErr);
    })


getKeycloakAccessToken(){
  const url = 'http://keycloak-keycloak.router.default.svc.cluster.local.......nip.io/auth/realms/myRealm/protocol/openid-connect/token';
  const authH = new HttpHeaders().set('Content-Type', 'application/x-www-form-urlencoded');
  const body = new HttpParams()
       .set('username', 'sample')
       .set('password', 'sample')
       .set('grant_type', 'password').set('client_id','rest-client');
  return this.http.post(url, body,{headers:authH,observe:'response'});

}
getKeycloakRoles(access_token){
  const url = 'http://keycloak-keycloak.router.default.svc.cluster.local........nip.io/auth/admin/realms/myRealm/roles'
  const authH = new HttpHeaders().set('Authorization','Bearer ' + access_token);//   ({'Authorization':'Bearer ' + access_token});
  return this.http.get(url,{headers:authH,observe:'response'});
}

and when I tried to debug, the access_token shown in console is different from that of request headers

[![network log][2]][2]

After debugging for couple of days, I figured out the reason for the difference in Access token, the API call is being invoked with the access_token of logged in session, though the program has source code written to set the headers set with access token of user 'sample/sample'. is there any way to trigger the API with the given access_token rather with the logged in user's access_token.

Answer 1

This might not be the solution, but just a couple of workarounds that worked for me.

1. Allow permissions (set 'Relam Management') to all the logged in users from the key cloak admin console, this way irrespective of user, whoever logs in will be able access the rest Admin APIs, follow this below reference

2. From keycloak client library, we have a initializeKeycloak() , that has configurations set for the application, so disable the 'enableBearerInterceptor' which will say the application not to use the access_token generated by logged in user to set the headers of each request. this way we can avoid the forbidden error.

But with approach no.2, you can not use the AT of logged in user as we r disabling the enableBearerInterceptor. And with solution no.1, if you are not having control on who are the users logging in to your application, i,e using some third party tool like LDAP to set the users, then it this won't serve the solution.