Getting AccessToken from KeyCloak on CLI

access-token.sh

#!/usr/bin/env bash
#
# env-vars
# - CLIENT_ID
# - CLIENT_SECRET
# - ISSUER_URL
# - USERNAME
# - PASSWORD

[ -r .env ] && source .env
usage() {
    echo "$(basename $0) [-d|-H] [-i <issuer> -r <realm> -u <user> -p <password> -c <client_id> -s <client_secret>] " 1>&2
    echo 1>&2
    echo "The following env-vars can be used:" 1>&2
    echo " - ISSUER" 1>&2
    echo " - CLIENT_ID" 1>&2
    echo " - CLIENT_SECRET" 1>&2
    echo " - USERNAME" 1>&2
    echo " - PASSWORD" 1>&2
    echo "This script will also source .env in CWD" 1>&2
    exit 1
}


base64decode() {
    local mod
    local encoded
    mod=$((${#1}%4))
    if [ $mod -eq 1 ]; then
        encoded="$1="
    elif [ $mod -gt 1 ]; then 
        encoded="$1=="
    else 
        encoded="$1"
    fi
    echo "$encoded" | base64 -d
}


while getopts ":dHr:i:u:p:c:s" OPT; do
    case "$OPT" in 
        d)
            DECONSTRUCT=true
            ;;
        H)
            HEADER=true
            ;;
        r)
            REALM=${OPTARG}
            ;;
        i)
            ISSUER=${OPTARG}
            ;;
        s)
            CLIENT_SECRET=${OPTARG}
            ;;
        c)
            CLIENT_ID=${OPTARG}
            ;;
        u)
            USERNAME=${OPTARG}
            ;;
        p)
            PASSWORD=${OPTARG}
            ;;
        *)
            usage
            ;;
    esac
done
shift $((OPTIND-1))

if [ -n "${DECONSTRUCT}" ] && [ -n "${HEADER}" ]; then 
    echo "!cannot both deconstruct token and output header" 1>&2
    exit 2
fi 


if [ -z "${REALM}" ]; then 
    echo "!no ISSUER_URL" 1>&2
    exit 2
fi

if [ -z "${ISSUER}" ]; then 
    echo "!no ISSUER_URL" 1>&2
    exit 2
fi

if [ -z "${CLIENT_ID}" ]; then 
    echo "!no CLIENT_ID" >&2
    exit 2
fi

# if [ -z "${CLIENT_SECRET}" ]; then 
#     echo "!no CLIENT_SECRET" >&2
#     exit 2
# fi

if [ -z "${USERNAME}" ]; then 
    echo "!no USERNAME" >&2
    exit 2
fi

if [ -z "${PASSWORD}" ]; then 
    echo "!no PASSWORD" >&2
    exit 2
fi



ISSUER_URL="${ISSUER}/realms/${REALM}/protocol/openid-connect/token"
result=$(curl -s -L \
  -d client_id=${CLIENT_ID} \
  -d client_secret=${CLIENT_SECRET} \
  -d grant_type=password \
  -d username=${USERNAME} \
  -d password=${PASSWORD} \
  -d scope="openid profile email" \
  ${ISSUER_URL})


if [[ $? != 0 ]]; then
  echo "Error!" >&2
  echo $result >&2
  exit 1
fi

ACCESS_TOKEN=$(echo $result | jq -r .access_token)

if [ -n "${DECONSTRUCT}" ]; then 
    echo "HEADER"
    p1=$(echo -n $ACCESS_TOKEN | cut -d '.' -f1) 
    base64decode "$p1" | jq

    echo "TOKEN"
    p2=$(echo -n $ACCESS_TOKEN | cut -d '.' -f2)
    base64decode "$p2" | jq

    exit 0
fi 

if [ -n "${HEADER}" ]; then 
    printf "Authorization: Bearer %s" $ACCESS_TOKEN
    exit 0
fi

echo $ACCESS_TOKEN