Getting first name, last name and email from Keycloak using Quarkus OIDC integration

Question

When I access the /openid-connect/token endpoint using admin_cli client_id I can see more/different info in the payload of returned access_token compared to when token is injected into my bean by the Quarkus OIDC/Keycloak extension.

Here are some samples:

{
  "exp": 1671084133,
  "iat": 1671083533,
  "jti": "b95bac0a-f95e-413d-b2cd-3b97fcf5f3c8",
  "iss": "http://localhost:51521/realms/my-realm",
  "sub": "cda64011-47a8-4a6a-8aac-06c7db6fc593",
  "typ": "Bearer",
  "azp": "admin-cli",
  "session_state": "be12a28b-4143-4bbf-9914-c8454d93f50f",
  "acr": "1",
  "scope": "profile email",
  "sid": "be12a28b-4143-4bbf-9914-c8454d93f50f",
  "email_verified": false,
  "preferred_username": "test",
  "given_name": "vasia",
  "family_name": "pupkin",
  "email": "[email protected]"
}

Versus

{
  "exp": 1671086253,
  "iat": 1671085653,
  "auth_time": 1671085653,
  "jti": "05e9f66d-54a1-440b-9295-3ebd681a853a",
  "iss": "http://localhost:51521/realms/my-realm",
  "sub": "cda64011-47a8-4a6a-8aac-06c7db6fc593",
  "typ": "Bearer",
  "azp": "my-app",
  "session_state": "ba00821c-1556-4214-90d7-5f2a55b0074a",
  "scope": "openid microprofile-jwt",
  "sid": "ba00821c-1556-4214-90d7-5f2a55b0074a",
  "upn": "test",
  "groups": [
    "offline_access",
    "admin",
    "uma_authorization",
    "default-roles-collar-club"
  ]
}

I'm interested in still getting the groups (for role based access) and given_name, family_name, email properties as well in my Quarkus app. Tried to specify: quarkus.oidc.authentication.scopes=openid,profile,groups - getting error in the url redirected from Keycloak:

2022-12-14 23:11:19,984 DEBUG [io.qua.oid.run.CodeAuthenticationMechanism] (vert.x-eventloop-thread-2) Authentication has failed, error: invalid_scope, description: Invalid scopes: openid openid profile groups

Answer 1

openid is always added by Quarkus, Keycloak does not like duplicate scope values, so remove openid

Answer 2

Figured it out... For anybody looking to achieve the same - make sure you have the right scope(s) added to the client in Keycloak (Clients -> Client Scopes -> Add client Scope). screenshot with email scope added