JWT from Keycloak to use REST API

[cleanee]

Hello,

I try to call REST API throught a Keycloak Oauth.

I setup the OIDC for the Web Admin. It works. And I can login with the same keycloak session on 2 sftpgo.

I try to call the Rest API when a fresh token from keycloak realms/${keycloak_realm}/protocol/openid-connect/token.

I got a 401 (log : 2024-11-28T09:22:02.385048216Z {"level":"debug","time":"2024-11-28T09:22:02.384","sender":"httpd","message":"error getting jwt token: token is unauthorized"})

The Keycloak POST request body is :

scope: "openid profile email"
client_id: "SAME_AS_SFTPGO_OIDC"
client_secret: "SAME_AS_SFTPGO_OIDC"
username: "EXISTING_USER_IN_WEB_ADMIN_AND_KEYCLOAK"
password: "********"

The token payload data :

{
  "exp": 1732785683,
  "iat": 1732785383,
  "jti": "****",
  "iss": "SAME_AS_SFTPGO_OIDC",
  "aud": "SAME_AS_SFTPGO_OIDC",
  "sub": "****",
  "typ": "Bearer",
  "azp": "sftpgo-client",
  "session_state": "****",
  "acr": "1",
  "scope": "openid sftpgo_role profile email",
  "sid": "****",
  "email_verified": false,
  "preferred_username": "EXISTING_USER_IN_WEB_ADMIN_AND_KEYCLOAK",
  "sftpgo_role": "admin"
}

I try the same call with the basic auth /api/v2/token. It works.

The token payload data :

{
  "aud": [
    "API",
    "**.***.**.*"
  ],
  "exp": 1732785828,
  "jti": "****",
  "nbf": 1732784598,
  "permissions": [
    "*"
  ],
  "sub": "****",
  "username": "EXISTING_USER_IN_WEB_ADMIN_AND_KEYCLOAK"
}