fix client scope non-default, add support too large access tokens on authorization flow (#660)

Author: 4rthem

configurator/src/Configurator/Vendor/Keycloak/KeycloakConfigurator.php

@@ -103,7 +103,9 @@ private function configureClients(): void
             'openid',
             'groups',
         ] as $scope) {
-            $this->keycloakManager->createScope($scope);
+            $this->keycloakManager->createScope($scope, [
+                'type' => 'default',
+            ]);
         }
 
         foreach ($this->getAppScopes() as $app => $appScopes) {
@@ -140,7 +142,7 @@ private function configureClients(): void
 
             if (isset($appScopes[$app])) {
                 foreach ($appScopes[$app] as $scope) {
-                    $this->keycloakManager->addScopeToClient($scope, $clientData['id']);
+                    $this->keycloakManager->addScopeToClient($scope, $clientData['id'], false);
                 }
             }
         }
@@ -170,7 +172,7 @@ private function configureClients(): void
             );
 
             foreach ($this->getAppScopes()['databox'] as $scope) {
-                $this->keycloakManager->addScopeToClient($scope, $clientData['id']);
+                $this->keycloakManager->addScopeToClient($scope, $clientData['id'], false);
             }
         }
     }
@@ -240,7 +242,7 @@ private function configureClient(
             'openid',
             'profile',
         ] as $scope) {
-            $this->keycloakManager->addScopeToClient($scope, $clientData['id']);
+            $this->keycloakManager->addScopeToClient($scope, $clientData['id'], true);
         }
 
         return $clientData;
@@ -318,9 +320,9 @@ private function getBooleanEnv(string $name, bool $defaultValue = false): bool
 
     private function configureDefaultClientScopes(): void
     {
-        $rolesScope = $this->keycloakManager->getDefaultClientScopesByName('roles');
+        $rolesScope = $this->keycloakManager->getDefaultClientScopeByName('roles');
         if (null === $rolesScope) {
-            throw new \InvalidArgumentException(sprintf('Scope named "roles" not found in client scopes'));
+            throw new \InvalidArgumentException('Scope named "roles" not found in client scopes');
         }
         $scopeId = $rolesScope['id'];
 

configurator/src/Configurator/Vendor/Keycloak/KeycloakManager.php

@@ -109,11 +109,11 @@ public function getDefaultClientScopes(): array
         ]))->toArray();
     }
 
-    public function getDefaultClientScopesByName(string $name): ?array
+    public function getDefaultClientScopeByName(string $name): ?array
     {
         $scopes = $this->getDefaultClientScopes();
         foreach ($scopes as $scope) {
-            if ('roles' === $scope['name']) {
+            if ($name === $scope['name']) {
                 return $scope;
             }
         }
@@ -232,12 +232,19 @@ private function getScopeByName(string $name): ?array
         return null;
     }
 
-    public function addScopeToClient(string $scope, string $clientId): void
+    public function addScopeToClient(string $scope, string $clientId, bool $isDefault): void
     {
         $scopeData = $this->getScopeByName($scope);
 
         HttpClientUtil::debugError(fn () => $this->getAuthenticatedClient()
-            ->request('PUT', UriTemplate::resolve('{realm}/clients/{clientId}/default-client-scopes/{scopeId}', [
+            ->request('DELETE', UriTemplate::resolve('{realm}/clients/{clientId}/'.(!$isDefault ? 'default' : 'optional').'-client-scopes/{scopeId}', [
+                'realm' => $this->keycloakRealm,
+                'clientId' => $clientId,
+                'scopeId' => $scopeData['id'],
+            ])), 404, []);
+
+        HttpClientUtil::debugError(fn () => $this->getAuthenticatedClient()
+            ->request('PUT', UriTemplate::resolve('{realm}/clients/{clientId}/'.($isDefault ? 'default' : 'optional').'-client-scopes/{scopeId}', [
                 'realm' => $this->keycloakRealm,
                 'clientId' => $clientId,
                 'scopeId' => $scopeData['id'],

lib/php/auth-bundle/Security/OAuthAuthorizationAuthenticator.php

@@ -34,6 +34,7 @@ public function __construct(
         private readonly UrlGeneratorInterface $urlGenerator,
         private readonly KeycloakUrlGenerator $keycloakUrlGenerator,
         private readonly AuthStateEncoder $authStateEncoder,
+        private readonly JwtExtractor $jwtExtractor,
         private readonly string $clientId,
     ) {
     }
@@ -61,7 +62,12 @@ public function authenticate(Request $request): Passport
         $accessTokenBadge = new AccessTokenBadge($accessToken);
         $refreshTokenBadge = new RefreshTokenBadge($refreshToken);
 
-        return new SelfValidatingPassport(new UserBadge($accessToken), [
+        $token = $this->jwtExtractor->parseJwt($accessToken);
+        $user = $this->jwtExtractor->getUserFromToken($token);
+
+        return new SelfValidatingPassport(new UserBadge($user->getUserIdentifier(), function () use ($user): JwtUser|JwtOauthClient {
+            return $user;
+        }), [
             $accessTokenBadge,
             $refreshTokenBadge,
         ]);