RBAC w/ Keycloak #3991
-
Issue submitter TODO list
Describe the bug (actual behavior)When attempting to configure RBAC (Role-Based Access Control) on Kafka-ui with Keycloak, no clusters are being displayed. I am using Keycloak v21.1.2 configured as Generic OAuth. Expected behaviorThe expected behavior is to display the configured cluster. I have tested using GitHub as the authentication system with the organization type, and no anomalies were detected Your installation detailsVersion Keycloak v21.1.2 kafka: rbac: I executed Kafka-ui using Docker with the following command: Steps to reproduceOpen the Kafka-ui login page. ScreenshotsNo response Logs`09:53:25,583 |-INFO in ch.qos.logback.classic.LoggerContext[default] - This is logback-classic version 1.4.6 | | | |_ | / |_ _ _ /\ _ __ __ _ | | ___ | |/ /_ _ / | |____ 2023-06-30 09:53:27,247 INFO [background-preinit] o.h.v.i.u.Version: HV000001: Hibernate Validator 8.0.0.Final Using generated security password: 2cdb66ac-808e-4b1a-a36e-70a1582ec6c5 2023-06-30 09:53:34,536 INFO [main] c.p.k.u.c.a.OAuthSecurityConfig: Configuring OAUTH2 authentication. 2023-06-30 09:53:37,654 INFO [parallel-2] o.a.k.c.u.AppInfoParser: Kafka version: 3.3.1 Additional contextNo response |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 19 replies
-
|
Hello there Gemini1983! 👋 Thank you and congratulations 🎉 for opening your very first issue in this project! 💖 In case you want to claim this issue, please comment down below! We will try to get back to you as soon as we can. 👀 |
Beta Was this translation helpful? Give feedback.
-
|
The clusters are not visible because you don't have any permissions granted. The obvious reason for this is that you don't have any keycloak roles assigned. This could be verified by calling |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for your fast reply. Regarding the 'roles-field' parameter to configure in Kafka-UI, should it be set as 'realm_access' in this case?" |
Beta Was this translation helpful? Give feedback.
-
|
https://discord.com/channels/897805035122077716/1110687228415451166/1113239293977178133 |
Beta Was this translation helpful? Give feedback.
-
|
What is value of param "roles-filed" for keycloak? thanks for reply! |
Beta Was this translation helpful? Give feedback.
-
|
The default value for the "roles-field" parameter in Keycloak is "realm_access.roles". However, Kafka-UI does not support nested roles in this structure. This limitation is why I opened an enhancement request on GitHub: #4024 If you have access to Keycloak, you can modify the default behavior (although it is not recommended) or create a custom mapping within your realm. By creating a new field specifically for roles, you can use its name as the value for "roles-field". |
Beta Was this translation helpful? Give feedback.
-
|
For future reference and people without discord accounts: auth:
type: OAUTH2
oauth2:
client:
keycloak:
clientId: xxx
clientSecret: yyy
scope: openid
issuer-uri: https://<keycloak_instance>/auth/realms/<realm>
user-name-attribute: preferred_username
client-name: keycloak
provider: keycloak
custom-params:
type: keycloak --> I had to change this to oauth instead of keycloak, it had to match the provider value in the subject, no sure if it would also work with changing the provider value in the subject to keycloak.
roles-field: --> this is the claim name inside the token from keycloak where to look for the roles, righ now this only supports on level deep in the json. So you need to add a custom mapper to your client mapping the role (either client or realm role) to a top level claim. subjects:
- provider: oauth
type: role
value: "role-name" |
Beta Was this translation helpful? Give feedback.
-
|
@fallen-up nope, you'd need a custom mapper, which is like, 2 clicks in UI :) |
Beta Was this translation helpful? Give feedback.
-
|
@Haarolean yeap, got to that last night, it was easier than it looked.
|
Beta Was this translation helpful? Give feedback.
-
|
@fallen-up feel free to update our docs with the information you might think will reduce the confusion |
Beta Was this translation helpful? Give feedback.
-
|
@hoeggi @fallen-up I followed what you said I see the claim in the logs in top level (roles) but it still does not match my permissions properly. Could you please paste your example from the |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
The clusters are not visible because you don't have any permissions granted. The obvious reason for this is that you don't have any keycloak roles assigned. This could be verified by calling
/api/authorizationendpoint.Also, you're missing the param "roles-field" required for RBAC.