witcom-gmbh / keycloak-authz-angular Goto Github PK

Hey everyone!

I would like to know if this package is still actively maintained? If yes, is it possible to use the latest Angular version (14) for the peer dependencies?

Greets

Hi, I tried to follow the documentation and created my own Guard to check the user has permissions to see one specific page, this is what I have in my routing module:

const routes: Routes = [
  {
    path: '',
    component: PurchaseComponent,
    canActivate: [KeycloakPermissionGuard],
    data: {
      permissions: [
        {
          rsname: 'purchase',
          scope: 'action'
        }
      ]
    }
  }
];

And this is my code in the KeycloakPermissionGuard guard:

   if (!this.authenticated) {
      this.keycloakService.login();
      return;
    }

    const requiredRoles = route.data.roles;
    const requiredPermissions = route.data.permissions;

    if (!(requiredPermissions && requiredPermissions.length > 0) && !(requiredRoles && requiredRoles.length > 0)) {
      return resolve(true);
    }

    let granted: boolean = true;

    if (requiredRoles) {
      let roles = this.keycloakService.getUserRoles();
      granted = requiredRoles.every(r => roles.indexOf(r) > -1);
    }

    if (granted && requiredPermissions) {
      for (const requiredPermission of requiredPermissions) {
        if (!this.keycloakAuthorization.checkAuthorization(requiredPermission)){
            granted = false;
            break;
        }
      }
    }

    resolve(granted);

While debugging in the browser, I noticed the guard got activated a lot of times, and every time it went it the 'not authenticated' if, and tried to log in into keycloak again and again. When the guard got activated, the keycloakService and keycloakAuthorizationService, where not initialized yet, and the token was not loaded, thus no permissions, at the end, after waiting for long, those services got initialized, and finally evaluated the permissions. So I wonder if I'm doing something wrong, or this is a bug in the library? How could I get rid of that problem? I would like to use permissions to check if user should see one specific page or get forbidden display shown.

zone.js:3243 POST http://localhost:8080/auth/realms/VMS/protocol/openid-connect/token 400 (Bad Request)
The response was client secret not provided in request

So i checked in postman passing authtoken

Checked the response token and i see the list of resources and scopes

can you provide an example ?