403 on userinfo endpoint

[kristofvb]

Hello,

when adding quarkus.oidc.authentication.user-info-required=true to the application.properties of the security-openid-connect-quickstart then the tests fail with a 401 and the following log line is shown

2025-11-13 09:16:54,922 ERROR [io.qua.oid.run.OidcProviderClientImpl] (vert.x-eventloop-thread-2) Request http://localhost:33706/realms/quarkus/protocol/openid-connect/userinfo has failed: status: 403
Is this expected behaviour? Somehow I would expect the tests to pass regardless of the setting of this property.

Thanks for looking into this.

[sberyozkin]

@kristofvb Hi, this is probably due to the fact that the tokens created in the test do not have an openid scope that is required for a successful UserInfo acquisition. One of the KeycloakTestClient methods for creating tokens accepts a scopes parameter, public String getAccessToken(String userName, String userSecret, String clientId, String clientSecret, List<String> scopes) for a password grant or String getClientAccessToken(String clientId, String clientSecret, List<String> scopes) for a client credentials grant.

So if you update the test code to use one of those methods, it should work

[sberyozkin]

HtmlUnit WebClient tests should continue working, it is just that you update the guide dealing with verifying bearer access tokens, code flow access tokens get this scope assigned to them automatically

[kristofvb]

Indeed.

Using the following, works
protected String getAccessToken(String userName) { return keycloakClient.getAccessToken(userName, userName, "backend-service", "secret", List.of("openid")); }
This gives a null access token (which I also find strange)
protected String getAccessToken(String userName) { return keycloakClient.getAccessToken(userName, userName, "backend-service", "secret", List.of("profile", "openid")); }

Anyway, in our code we didn't have to set it the property explicitly as it is set implicitly when role source is set to userinfo. So removing the setting solved it as well.

[sberyozkin]

@kristofvb

Using the following, works ...
protected String getAccessToken(String userName) { return keycloakClient.getAccessToken(userName, userName, "backend-service", "secret", List.of("openid")); }

OK

This gives a null access token (which I also find strange)
protected String getAccessToken(String userName) { return keycloakClient.getAccessToken(userName, userName, "backend-service", "secret", List.of("profile", "openid")); }

Most likely tokens that are obtained without using the authorization code flow, and hence, without a user's concern, are not authorized to access a user profile by Keycloak...