title: Keycloak: Authorization between services and the public frontend
body: <p>I have an application which consists of a frontend and several backend services. The authentication is done via Keycloak.
  The workflow looks like this:
  The user logs into the frontend and gets a token from Keycloak. This token is sent to the backend with every request.</p>
  <p>The following image explains the current architecture:</p>
  <p><a href="https://i.stack.imgur.com/OFncw.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OFncw.png" alt="enter image description here" /></a></p>
  <p>In Keycloak I have the following clients:</p>
  <p><strong>1. Frontend</strong></p>
  <ul>
  <li>Access Type: public</li>
  <li>Client Protocol: openid-connect</li>
  </ul>
  <p><strong>2. Core Service</strong></p>
  <ul>
  <li>Access Type: bearer-only</li>
  <li>Client Protocol: openid-connect</li>
  </ul>
  <p><strong>3. User Service</strong></p>
  <ul>
  <li>Access Type: bearer-only</li>
  <li>Client Protocol: openid-connect</li>
  </ul>
  <p>How can I validate calls between services now?</p>
  <p>I would imagine something like a service account and these have the possibility to call each other independently from the bearer-token from the frontend. The problem is that both services can be called from the frontend as well as between each other.</p>
  <p><strong>Edit:</strong></p>
  <p>My API is written with NestJS.</p>
  <p>The API of the user-service:
  <a href="https://i.stack.imgur.com/ys267.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ys267.png" alt="enter image description here" /></a></p>
  <p>And this is how I call the user-service in my core-service:
  <a href="https://i.stack.imgur.com/E54hZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/E54hZ.png" alt="enter image description here" /></a></p>
  <p>and this is my keycloak configuration for the the user-service:
  <a href="https://i.stack.imgur.com/bmuFf.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bmuFf.png" alt="enter image description here" /></a></p>
  <p>At the moment I don't add anything to the request and I don't have any extra configuration on the interface. So I added the <code>@Resource('user-service')</code>-Annotation to the Controller and the <code>@Scope()</code>-Annotation to the Endpoint.</p>
  <p>After that I don't get an error immediately and the endpoint is called.I can log that the logic is executed. But as response I still get a 401 Unauthorized Error.</p>
  <p>Do I need to specify a scope or what do I need to add in the <code>@Resource</code>-Annotation?</p>
  <p><strong>Edit 2:</strong></p>
  <p>I'll try to show you my current situation with many screenshots.</p>
  <h1>Initial situation</h1>
  <p><a href="https://i.stack.imgur.com/fXdOj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fXdOj.png" alt="enter image description here" /></a></p>
  <p>Here is your drawing again. For me, points 1-5 work and point 8 works even if I do not call another service.</p>
  <h1>My Configuration</h1>
  <p>That this works, I have the following configuration:</p>
  <h2>Just Frontend and Core Service</h2>
  <p>Frontend:
  <a href="https://i.stack.imgur.com/n6Jl8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/n6Jl8.png" alt="enter image description here" /></a></p>
  <p>Core-Service:
  <a href="https://i.stack.imgur.com/KEvYN.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/KEvYN.png" alt="enter image description here" /></a></p>
  <p>For the core service (gutachten-backend), I do not need to make any further configurations for this. I also have 2 different roles and I can specify them within the API.</p>
  <p>Using Postman I send a request to the API and get the token from <a href="http://KEYCLOAK-SERVER_URL/auth/realms/REALM_NAME/protocol/openid-connect/token" rel="nofollow noreferrer">http://KEYCLOAK-SERVER_URL/auth/realms/REALM_NAME/protocol/openid-connect/token</a>.</p>
  <p><a href="https://i.stack.imgur.com/EM0NC.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/EM0NC.png" alt="enter image description here" /></a></p>
  <p>These are my 2 testing methods. I call the first one and it works. The following is logged. Means the token is validated received and I get Access:
  <a href="https://i.stack.imgur.com/u4a6s.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/u4a6s.png" alt="enter image description here" /></a></p>
  <h2>Calling the user service</h2>
  <p>Now I call the second method. This method calls the user-service.</p>
  <p>This is my request in the core-service:
  <a href="https://i.stack.imgur.com/6SywX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/6SywX.png" alt="enter image description here" /></a>
  I do not add anything else to my request. Like a bearer token in the header.</p>
  <p>The endpoint in the user service is just a test method which logs a message.</p>
  <p>This is my configuration for the user service:
  <a href="https://i.stack.imgur.com/kBvza.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/kBvza.png" alt="enter image description here" /></a></p>
  <p>I have now tried something with resources, policies and permissions.</p>
  <h3>Resource</h3>
  <p><a href="https://i.stack.imgur.com/BjKPu.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BjKPu.png" alt="enter image description here" /></a></p>
  <h3>Policies</h3>
  <p>Role-Policy
  <a href="https://i.stack.imgur.com/EsXpZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/EsXpZ.png" alt="enter image description here" /></a></p>
  <p>Client-Policy:
  <a href="https://i.stack.imgur.com/HTyWV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HTyWV.png" alt="enter image description here" /></a></p>
  <h3>Permission</h3>
  <p><a href="https://i.stack.imgur.com/5EReC.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/5EReC.png" alt="enter image description here" /></a></p>
  <p>And analogously the client permission</p>
  <h1>Questions and thoughts</h1>
  <ul>
  <li>All steps from the first drawing seem to work except 6 and 7</li>
  <li>Do I need to add more information to my request from core service to user service?</li>
  <li>How to deal with root url and resource urls?</li>
  <li>In the code in the API, do I need to additionally configure the endpoints and specify the specific resources and policies? (NestJS offers the possibility to provide controllers with a <code>@Resource('&lt;name&gt;')</code> and endpoints with <code>@Scopes([&lt;list&gt;]))</code>
  Additionally, through a tutorial on setting up keyacloak in NestJS, I turned on the following config:</li>
  </ul>
  <blockquote>
  <p>This adds a global level resource guard, which is permissive.
  Only controllers annotated with @Resource and
  methods with @Scopes are handled by this guard.</p>
  </blockquote>