You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@fineract.apache.org by Honest Chirozva <ho...@taatconsulting.com> on 2023/09/20 22:27:24 UTC
OAUTH2 CONFIGURATION
Hi team,
Can anyone assist me on the configurations I can use for OAuth2 using Keycloak with latest Fineract? I have enabled OAuth2 on the Fineract API and it was a success, however I have problems on the Keycloak configurations, what do I need to do? Every token I generate from Keycloak is being rejected by the Fineract API – getting 401 Unauthorized
Regards.
Honest Chirozva
Technical Consultant
TAAT Consulting
Re: OAUTH2 CONFIGURATION
Posted by Aleksandar Vidakovic <ch...@monkeysintown.com>.
... what you can expect in 1.9 is the "all batteries included" OAuth
support with Spring Authorization Server. I'll try my best to get
Keycloak (actually: any external OAuth compliant ID server) in there
too... but it's a bit tight.
Cheers,
Aleks
On 21/09/2023 08:35, Honest Chirozva wrote:
>
> Thank you Aleks,
>
> Is this a feature we can expect on the new 1.9 release?
>
> Regards.
>
> Honest Chirozva
> Technical Consultant
>
> TAAT Consulting
>
> *From: *Aleksandar Vidakovic <ma...@monkeysintown.com>
> *Sent: *Thursday, 21 September 2023 07:52
> *To: *Dev <ma...@fineract.apache.org>
> *Subject: *Re: OAUTH2 CONFIGURATION
>
> ... I am currently working on that... there will be an update soon.
>
> On Thu, 21 Sept 2023, 00:27 Honest Chirozva,
> <ho...@taatconsulting.com> wrote:
>
> Hi team,
>
> Can anyone assist me on the configurations I can use for OAuth2
> using Keycloak with latest Fineract? I have enabled OAuth2 on the
> Fineract API and it was a success, however I have problems on the
> Keycloak configurations, what do I need to do? Every token I
> generate from Keycloak is being rejected by the Fineract API –
> getting 401 Unauthorized
>
> Regards.
>
> Honest Chirozva
> Technical Consultant
>
> TAAT Consulting
>
RE: OAUTH2 CONFIGURATION
Posted by Honest Chirozva <ho...@taatconsulting.com>.
Thank you Aleks,
Is this a feature we can expect on the new 1.9 release?
Regards.
Honest Chirozva
Technical Consultant
TAAT Consulting
From: Aleksandar Vidakovic<ma...@monkeysintown.com>
Sent: Thursday, 21 September 2023 07:52
To: Dev<ma...@fineract.apache.org>
Subject: Re: OAUTH2 CONFIGURATION
... I am currently working on that... there will be an update soon.
On Thu, 21 Sept 2023, 00:27 Honest Chirozva, <ho...@taatconsulting.com>> wrote:
Hi team,
Can anyone assist me on the configurations I can use for OAuth2 using Keycloak with latest Fineract? I have enabled OAuth2 on the Fineract API and it was a success, however I have problems on the Keycloak configurations, what do I need to do? Every token I generate from Keycloak is being rejected by the Fineract API – getting 401 Unauthorized
Regards.
Honest Chirozva
Technical Consultant
TAAT Consulting
Re: OAUTH2 CONFIGURATION
Posted by Aleksandar Vidakovic <ch...@monkeysintown.com>.
... I am currently working on that... there will be an update soon.
On Thu, 21 Sept 2023, 00:27 Honest Chirozva, <ho...@taatconsulting.com>
wrote:
> Hi team,
>
>
>
> Can anyone assist me on the configurations I can use for OAuth2 using
> Keycloak with latest Fineract? I have enabled OAuth2 on the Fineract API
> and it was a success, however I have problems on the Keycloak
> configurations, what do I need to do? Every token I generate from Keycloak
> is being rejected by the Fineract API – getting 401 Unauthorized
>
>
>
> Regards.
>
> Honest Chirozva
> Technical Consultant
>
> TAAT Consulting
>
>
>
Re: OAUTH2 CONFIGURATION
Posted by Aleksandar Vidakovic <ch...@monkeysintown.com>.
... the new thing will be that authorization will be a modular feature...
one incarnation will be JDBC based and look like ( read: 100% backward
compatible with) the existing solution. But then there will be one where
you will be able to manage roles, permissions via your OAuth server (aka
Keycloak)... and we are thinking about throwing an implementation based on
Open Policy Agent (popular in the Kubernetes world) into the mix.
Not there yet, but that is the plan in broad strokes.
Aleks
On Sat, 23 Sept 2023, 09:02 NgPS, <ng...@objectmemetic.com> wrote:
> On Sat, Sep 23, 2023 at 06:10:20AM +0200, Aleksandar Vidakovic wrote:
> > ... note: integrating external oauth servers is really easy now... at
> least
> > the authentication part... authorization needs a bit more work.
>
> For authorization, I was looking at the existing m_appuser_role and
> m_role_permissions mappings. They work right?
>
> Is there something new in the pipeline?
>
> PS
>
Re: OAUTH2 CONFIGURATION
Posted by NgPS <ng...@objectmemetic.com>.
On Sat, Sep 23, 2023 at 06:10:20AM +0200, Aleksandar Vidakovic wrote:
> ... note: integrating external oauth servers is really easy now... at least
> the authentication part... authorization needs a bit more work.
For authorization, I was looking at the existing m_appuser_role and m_role_permissions mappings. They work right?
Is there something new in the pipeline?
PS
Re: OAUTH2 CONFIGURATION
Posted by Aleksandar Vidakovic <ch...@monkeysintown.com>.
... note: integrating external oauth servers is really easy now... at least
the authentication part... authorization needs a bit more work. Before you
search too long: look for spring oauth client configuration.
On Sat, 23 Sept 2023, 05:00 NgPS, <ng...@objectmemetic.com> wrote:
> On Wed, Sep 20, 2023 at 10:27:24PM +0000, Honest Chirozva wrote:
> > Can anyone assist me on the configurations I can use for OAuth2 using
> Keycloak with latest Fineract? I have enabled OAuth2 on
> > the Fineract API and it was a success, however I have problems on the
> Keycloak configurations, what do I need to do? Every
> > token I generate from Keycloak is being rejected by the Fineract API –
> getting 401 Unauthorized
>
> Have you decoded the tokens you get from Keycloak at https://jwt.io or
> https://jwt.ms? Might get some hints
> there.
>
> I have Fineract running with Keycloak. I did these on Keycloak:
>
> - created a realm
> - created user 'mifos' in the realm
> - configured my SMTP server to allow Keycloak sending mail thru it
> (optional if you just want to get auth working)
>
> PS
>
Re: OAUTH2 CONFIGURATION
Posted by NgPS <ng...@objectmemetic.com>.
On Wed, Sep 20, 2023 at 10:27:24PM +0000, Honest Chirozva wrote:
> Can anyone assist me on the configurations I can use for OAuth2 using Keycloak with latest Fineract? I have enabled OAuth2 on
> the Fineract API and it was a success, however I have problems on the Keycloak configurations, what do I need to do? Every
> token I generate from Keycloak is being rejected by the Fineract API – getting 401 Unauthorized
Have you decoded the tokens you get from Keycloak at https://jwt.io or https://jwt.ms? Might get some hints
there.
I have Fineract running with Keycloak. I did these on Keycloak:
- created a realm
- created user 'mifos' in the realm
- configured my SMTP server to allow Keycloak sending mail thru it (optional if you just want to get auth working)
PS