Context

Hi everyone, I am working on a 3 part application:

• Keycloak server for auth
• Angular app for the frontend (with dedicated client, public)
• express router for the backend (with dedicated client, bearer-only)

The first two parts work like a charm, I can authenticate against my KC server with my Angular app, get the roles, and so on..

This week, I started to work with the backend, installed keycloak-connect following the official documentation, and others, to troubleshoot my current issue.

This is the condensed code I am trying:

var express = require('express');
var session = require('express-session');
var Keycloak = require('keycloak-connect');

var memoryStore = new session.MemoryStore();
var keycloak = new Keycloak({ store: memoryStore });

var app = express();

//session
app.use(session({
  secret:'thisShouldBeLongAndSecret',
  resave: false,
  saveUninitialized: true,
  store: memoryStore
}));

app.use( keycloak.middleware() );

app.get('/check', keycloak.checksso('user'), function(req, res){
  console.log(req.headers);
  res.setHeader('Content-Type', 'application/json');
  res.end(JSON.stringify({ 'this': 'works!' }, null, 3));
});

app.get('/check', keycloak.enforce('user'), function(req, res){
  console.log(req.headers);
  res.setHeader('Content-Type', 'application/json');
  res.end(JSON.stringify({ 'this': 'does not work' }, null, 3));
});

app.listen(8000, function () {
  console.log('Listening at http://localhost:8000');
});

Beside I have a .json file provided by my KC server after I setup the bearer-only client, so this one should be just fine.

The issue

Note that, using .checkSSO() works as excepected, while using protect('my-role') or enforce('my-role') does not.

My express backend got the Angular token properly, and I checked for the role my-role using https://www.jstoolset.com/jwt service, and everything is fine.

I have enabled LOGLEVEL on my KC server, I got nothing at all using protect(), but I do got a message using enforce():

keycloak-connect : type=PERMISSION_TOKEN_ERROR, userId=null, ipAddress=, error=invalid_client_credentials

This is weird to me, as the dedicated client I am using for my backend, is configure as a bearer-only, and there is no place for such a secret within the configuration file my KC server is providing me...

I think I won't move further without your help, I was browsing all the week tried many leads, without luck so far...

Thank you for your help if any, kind strangers...