How to get Keycloak's roles?

[LoiKos]

I wanted to come back on this issue : #4811

I check both account & profile as recommended and i can find a lot of informations like access_token, refresh_token but roles are missing.

The only way i found to get the roles are to parsed the token myself :

import jwt from 'jsonwebtoken'
//...
 callbacks: {
    //...
    jwt: async (params) => {
      let roles = undefined as
        | { [key: string]: { roles: Array<any> } }
        | undefined

      if (account?.access_token) {
        let decodedToken = jwt.decode(account?.access_token)
        if (decodedToken && typeof decodedToken !== 'string') {
          roles = decodedToken?.resource_access
        }
      }
      //...
    }
 }

I'm not really comfortable with this approach and i'm wondering why it's missing from profile.
profile and decodedToken all fields are similar except for aud. profile is missing the following fields: realm_access and resource_access and scope.

Is this happening because other providers doesn't define these fields ?

[kwame-mintah]

@LoiKos, what version of Keycloak are you using? There is a way to include the roles as part of the access token.

[kwame-mintah]

@LoiKos - I have just tested this on my local instance and following the instructions above, you can get the roles to be returned when the scope is profile.

[LoiKos]

@kwame-mintah in fact it work correctly. My problem was not related to next-auth finally but with keycloak itself. I have a "." in my token claim name that cause it to not appearing in the token :/

[martinzokov]

Can you elaborate a bit on how you solved this please? I used your snippet like so:

callbacks: {
    async jwt({token, user, account, profile }) {
      
      //console.log("account "+ JSON.stringify(account))
      let roles = undefined as
        | { [key: string]: { roles: Array<any> } }
        | undefined

      if (account?.access_token) {
        let decodedToken = jwt.decode(account?.access_token)
        if (decodedToken && typeof decodedToken !== 'string') {
          roles = decodedToken?.realm_access
        }
      }
      token = {...token, roles: roles?.roles}
      console.log("[jwt callback] token " + JSON.stringify(token))
      return token;
    },
    session: async ({ session, token, user }) => {
      if (session?.user) {
        session.user.id = token.sub;
        
      }
      console.log("[session callback] token " + JSON.stringify(token))

      return session;
    },
  },

However, in my session callback it seems to be passing only the original token without the roles.
Logs:

[jwt callback] token {"name":"demouser","sub":"ec710553-6f5e-4a2f-ba8e-c30159175c1d","roles":["doctor"]}
...
[session callback] token {"name":"demouser","sub":"ec710553-6f5e-4a2f-ba8e-c30159175c1d","iat":1715281935,"exp":1717873935,"jti":"05f3536f-2b4e-412a-bed8-5eece7dafc43"}

[LoiKos]

I check your snippet and it seems that you change roles = decodedToken?.resource_access to roles = decodedToken?.realm_access. Did you try with resource_access ?

[martinzokov]

Yes, I think my roles just get sent in the realm_access property. I actually found a solution to my issue. I copy/pasted the config and oidc.ts from this repo: https://github.com/dkrasnovdev/nextjs-app-router-keycloak-example

Now it works for me!