I'm using the Keycloak Admin Rest API and would like to create a new client scope and get its id.
To create the client scope I use this endpoint:
http://localhost:8080/admin/realms/master/client-scopes
Body
{
"attributes": {
"display.on.consent.screen": "true",
"include.in.token.scope": "true"
},
"name": "example",
"protocol": "openid-connect"
}
This endpoint doesn't return a result but I need the ID.
To get the ID I could get all client scopes and find the scope with the matching name however I would have thought there would be a simpler way.
E.g. GET http://localhost:8080/admin/realms/master/client-scopes then filter through the results to find a matching name.
Is it possible to get a client scope by name?
Is it possible to get a client scope by name?
Unfortunately, not, which is a pity because the 'name' is unique. If you look at the keycloak Rest Admin API you can see the followings GET for the client-scopes:
GET /{realm}/client-scopes
and
GET /{realm}/client-scopes/{id}
And none of those endpoints accepts as parameters 'name'.
Notwithstanding, as #csbrogi and #Jan Garaj have pointed out in the comment section, since you:
(..) create a new client scope and get its id.
You can retrieve the ID of the client-scope that was just created from the header location:
In the Keycloak, usually POST methods returns 201 or 200 OK without body as experienced. Thus, you cannot get the ID directly from response. What you can do is; assign a ID while creating scope as below body and you simply will have it.
{
"id": "da5a68f1-058c-481a-bf84-deb95b1f21aa",
"attributes": {
"display.on.consent.screen": "true",
"include.in.token.scope": "true"
},
"name": "example",
"protocol": "openid-connect"
}
Related
Requirements: We would like to create a Variable Group (along with some variables) in a given Project.
Option1: We are able to create a new Variable Group successfully
when we create a request via PostMan using PAT Token which has FULL access.
Option2: Our end goal is to invoke the ADO Rest API in the Web App which uses
OAuth. When the end user logs in and make a call (pls see the input
details below) we are getting '401 Un Authorized - The user is not authorized to access this resource.' error. The Web App's application has the Variable Groups manage scope as shown below.
TroubleShooting: As part of troubleshooting, for Option1 which uses PAT (with full access) in Postman, we have updated the permissions of the PAT to just have Create, Read and Manage Var Groups as shown below.
Now, even the Option1 is not working after making the PAT to have Custom Defined access.
Are we missing something?
Postman Details:
URL: https://dev.azure.com/myorgname/_apis/distributedtask/variablegroups?api-version=6.0-preview.2
Verb: Post
Headers: Authorization: Basic
Body:
{
"name": "This is ignored",
"description": "This is ignored",
"type": "Vsts",
"variables": {
"BuildConfiguration": {
"value": "Release"
}
},
"variableGroupProjectReferences": [
{
"name": "VarGroup",
"description": "The variable group to store the information about the variables using in the Pipeline",
"projectReference": {
"id": "#ProjectId#",
"name": "#ProjectName#"
}
}
]
}
I can also reproduce your issue with option 1, not only Read, create, & manage for Variable Groups, even I select all the scopes via Custom defined, it still does not work.
According to this doc - https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-creation-of-full-scoped-pats
Some of our public APIs are currently unassociated with a PAT scope, and can therefore only be used with “full-scoped” PATs. Because of this, restricting the creation of full-scoped PATs might block some workflows. We're working to identify and document the affected APIs and eventually associate them with the appropriate scope. For now, these workflows can be unblocked by using the allow list.
I believe this should be the reason for this issue, there may be some additional permissions to create variable groups. For option 2, there may be a similar cause.
So in this case, you may need to use the Full access PAT temporarily, as mentioned in the doc We're working to identify and document the affected APIs and eventually associate them with the appropriate scope.
I am creating a JSON API that implements the JSON:API specification. I have a question about it however, and this question applies more generally to RESTful design in general: What is the recommended way to handle the "creation" of a resource, where one of the attributes is "calculated" by the server?
In my example, I have a POST /auth/tokens endpoint that accepts a user's credentials and returns a JWT. I've used a POST endpoint, because it seems to me that we are creating a token resource, even if that token is not saved to a database. However, according to JSON:API, what would the proper request/response look like? This?:
POST /auth/tokens
{
"data": {
"type": "tokens",
"attributes": {
"email": "...",
"password": "..."
}
}
}
However, does it even make sense to create a token with an email and password? It seems that it would be creating a token for an email/password. Is there a difference?
More importantly, what would the response look like? It seems like it would look something like:
{
"data": {
"type": "tokens",
"attributes": {
"token": "..."
}
}
}
But the specification states:
Every resource object MUST contain an id member and a type member. The values of the id and type members MUST be strings.
Since the tokens aren't saved to the database, I don't really have an ID for them. What should I do?
JSON:API specification doesn't say anything about such case but if you look on some live implementations like https://docs.unit.co/customer-api-tokens#customers-create-customer-bearer-token they use similar approach as you described. It seems to be just ok in this case to omit ID for a resource which is short lived.
I want to assign the realm role "TEST_ROLE_123" to a group, I am using
PUT /admin/realms/ataccamaone/groups/{group-id}
{
"realmRoles":["TEST_ROLE_123"]
}
I got group-id from /admin/realms/ataccamaone/groups/
However I get the response 204 No Content and in the Keycloak console I do not see the assignment.
I tried to reproduce your problem and find that PUT /admin/realms/ataccamaone/groups/{group-id} can only edit group name.
Inspect into "Network" tab of browser, I see it uses another URL to map roles to groups. And steps to do this via Admin REST API are:
Obtain PAT as described in https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_protection_whatis_obtain_pat section
Following steps use this PAT as Bearer token (in "Authorization" header). I guess you've already got this.
Call GET http://localhost:8080/auth/admin/realms/realm1/roles to get list of roles, including their name and id values.
Call GET http://localhost:8080/auth/admin/realms/realm1/groups to get list of groups, including their ids
Call POST http://localhost:8080/auth/admin/realms/realm1/groups/{group-id}/role-mappings/realm with following body:
[
{
"id": "9083cac3-4280-497d-b973-7713a5fb12b4", // role-id
"name": "secretary" // role-name
}
]
Call DELETE with URL and body same as step 4 to remove roles from group.
I've faced same issue and corrected it with using a GROUP, Basically I've added the preferred ROLE into the User Groups ROLE LIST and used that specific user group while creating the user via REST API.
Eg:- ADMIN_USER_GROUP -> INCLUDED ('ADMIN_ROLE')
Then User creation API Request should be like below,
{
"firstName": "Sergey",
"lastName": "Kargopolov",
"email": "test4#test.com",
"enabled": "true",
"credentials": [
{
"value": "123"
}
],
"groups": [
"ADMIN_USER_GROUP"
]
}
Currently, I'm working on new product and making REST API for both - public and internal needs. I started with {json:api} specification and I was pretty happy with it until I faced some questions I cannot find answers to.
According to JSON API specification, every resource MUST contain id.
http://jsonapi.org/format/
Every resource object MUST contain an id member and a type member. The values of the id and type members MUST be strings.
And that's fine in many cases but not all.
Most of our endpoints are about "resources"
If I ask for a "things" collection (http://example.com/things)
{
"data": [{
"type": "things",
"id": "1",
"attributes": {
"title": "first"
},
"links": {
"self": "http://example.com/things/1"
}
}, {
"type": "things",
"id": "1",
"attributes": {
"title": "second"
},
"links": {
"self": "http://example.com/things/2"
}
}]
}
If I ask for a single "things" resource (http://example.com/things/1)
{
"data": {
"type": "things",
"id": "1",
"attributes": {
"title": "first"
},
"links": {
"self": "http://example.com/things/1"
}
}
}
But what to do with endpoints which are not about resources and does not have ID?
For example, in our application, there is an endpoint http://example.com/stats which should return stats of current logged in user. Like
{
"active_things": 23,
"last_login": "2017"
}
There is no id for this "resource" (it's not actually a resource, is it?). Backend just collects some "stats" for logged in user and returns an object of stats. There many endpoints like this in this application, for example, we have Notification center page where the user can change email addresses for different notifications.
So frontend app (single-page-app) first has to get current values and it sends the request to GET http://example.com/notification-settings.
{
"notifications_about_new_thing": "arunas#example.com",
"notification_about_other_thing": "arunas#example.com"
}
And there are many more endpoints like this. The problem is - how to return these responses in JSONAPI format? There is no ID in these endpoints.
And the biggest question is - why nobody else is facing this issue (at least I cannot find any discussion about this)? :D All APIs I ever made has some endpoints which don't have "id".
I have two ideas, first is to fake id, like "id": "doesnt_matter", the second - do not use json-api for these endpoints. But I don't like both of them.
Think RESTfully and everything can (must) be a resource. There is no "logged in" user as there are no sessions in RESTful APIs as they are stateless. There's no session state maintained between REST API invocations, so you have to be explicit about who the user is.
In this case, the resource is the user who has some stats attributes (in the simple case) or perhaps a relationship to a separate stats relationship (more complicated, not shown):
GET /users/1234
{
"data": {
"type": "users",
"id": "1234",
"attributes": {
"name": "etc.",
"active_things": 23,
"last_login": "2017"
}
}
}
I'm no JSON API expert- but it's worth noting that while JSON API is a concrete specification, it is not the same thing as JSON, nor as a REST API. If you don't like its semantics, I agree with commenters who argue, "Don't use it." If you are going to use JSON API, do so in a compliant way, where every response is a resource; every resource has an ID and a type; and additional information is supplied as attributes of the resource.
Toward your question, I'm thinking about something similar where my application returns computation results. Now on the one hand, these are not strictly "resources" and so I've been toying with the idea of returning the raw result as an array (which I believe would be valid JSON, with a caveat), e.g:
[ 47 ]
On the other hand, there is the idea that the results are the results of a computation that the client specified RESTfully, in which case one of the following two cases is likely true:
The same request submitted later is likely to have the same result. This suggests that in fact the result really is a resource.
The same request submitted later is likely to have a different result. This suggests that the client may want to track how results change for various queries, and so at least the query parameters should be part of the response.
In both cases, the response really is a 'result' object, and even though it doesn't have an ID per se, it does have an identity. If nothing else fits, the ID could be the query that generated the response.
This seems RESTful to me. User #n2ygk suggests that this is not correct as regards the JSON API spec, that an ID should simply be a unique ID and not have another semantic interpretation.
I'd love to hear other perspectives.
Let's say I know the group I'm interested in has this URL: https://www.facebook.com/groups/framerjs/.
I've been looking for a way to map an URL like this (without any other source of information) to a specific group ID, using the Graph API, but there seems no way to do that.
I've experimented with the following:
Accessing /me/groups:
This endpoint gives out the groups I've subscribed to (within which the group I'm looking for is included), but there's no information in the response that lets me map framerjs to an ID, since the response will only contain the full (formatted) group name, such as Framer JS.
Using the group alias directly, e.g. /framerjs/feed:
This returns an error like (#803) Some of the aliases you requested do not exist: framerjs, supposedly because the API only allows using aliases for users and/or pages, and not groups.
You can use the Search API:
/search?q=framerjs&type=group
Response:
{
"data": [
{
"name": "Framer JS",
"id": "385961098197634"
}
],
"paging": {
"next": "https://graph.facebook.com/v2.2/search?type=group&q=framerjs&icon_size=16&limit=5000&offset=5000&__after_id=enc_AewsQta1G58IkwuUNLJ8vZb35qrc0BS89MpO1ZiAVCRiwYjzWE_GkHRwxk6I1E5Sj2UprSuDxghIB4EJGEF8GxD7"
}
}