Cannot access resource_access.client-test.roles with Flask-OIDC and Keycloak - flask

Question

I configured Keycloak to authenticate the users of my client and return it's role to my application. The following JSON is the data Keycloak returns with OIDC for my user. In the data, we can clearly see that the field resource_access.test-client.roles is present.
{
....some data..
"allowed-origins": [
"http://localhost:5000"
],
"realm_access": {
"roles": [
"offline_access",
"uma_authorization"
]
},
"resource_access": {
"test-client": {
"roles": [
"DemoRole"
]
},
"account": {
"roles": [
"manage-account",
"manage-account-links",
"view-profile"
]
}
},
....some data..
}
In my application side I used Flask-OIDC to make the authentication and get my user role.
The app configuration was done this way
app.config.update({
'SECRET_KEY': 'u\x91\xcf\xfa\x0c\xb9\x95\xe3t\xba2K\x7f\xfd\xca\xa3\x9f\x90\x88\xb8\xee\xa4\xd6\xe4',
'TESTING': True,
'DEBUG': True,
'OIDC_CLIENT_SECRETS': 'client_secrets.json',
'OIDC_ID_TOKEN_COOKIE_SECURE': False,
'OIDC_REQUIRE_VERIFIED_EMAIL': False,
'OIDC_USER_INFO_ENABLED': True,
'OIDC_SCOPES': ['openid', 'email', 'profile', 'roles'],
'OIDC_VALID_ISSUERS': ['http://localhost:8080/auth/realms/MyDemo'],
'OIDC_OPENID_REALM': 'http://localhost:5000/oidc_callback'
})
The client_secrets.json is
{
"web": {
"auth_uri": "http://localhost:8080/auth/realms/MyDemo/protocol/openid-connect/auth",
"client_id": "test-client",
"client_secret": "40074399-b1b6-442c-9862-68b655ef8dad",
"redirect_uris": [
"http://localhost:5000/oidc_callback"
],
"userinfo_uri": "http://localhost:8080/auth/realms/MyDemo/protocol/openid-connect/userinfo",
"token_uri": "http://localhost:8080/auth/realms/MyDemo/protocol/openid-connect/token",
"token_introspection_uri": "http://localhost:8080/auth/realms/MyDemo/protocol/openid-connect/token/introspect"
}
}
This done, I'm trying to retrieve the role from my user in the following endpoint
#app.route('/private')
#oidc.require_login
def hello_me():
info = oidc.user_getinfo(['resource_access'])
client = info['test-client']
role = client['roles']
The problem is that 'info' is being returned empty. I can access the fields 'email', 'surname' and others, but I can't access 'resource_access', even it being present in the returned JSON. I expected that the sequence of code above could return me the user roles.
What am I doing wrong?

Answer 1

Claim resource_access can be exposed in the access token and/or id token and/or userinfo response. It is not clear from your problem description, where it is exposed exactly. Apparently it is in the wrong place and not where your application code is expecting that.
So fix location of the claim and you should be fine:
lazy option: expose it everywhere (access token and id token and userinfo response)
proper option: read documentation of used library and expose claim only to the right location (access token or id token or userinfo response)