Basic Keycloak Script Mapper to provide Hasura claims

Hasura Keycloak.md

Steps to provide Hasura Claims in Keycloak generated JWT

1. Create your realm / client
2. Inside client configuration go to "Mappers"
3. Click on "Create"
4. Name it "hasura"
5. Choose Mapper Type "Script Mapper"
6. Add following script to demonstrate how it works

/**
 * Available variables: 
 * user - the current user (UserModel)
 * realm - the current realm (RealmModel)
 * token - the current token (TokenModel)
 * userSession - the current userSession (UserSessionModel)
 * keycloakSession - the current keycloakSession (KeycloakSessionModel)
 */


//insert your code here...
var roles = [];
for each (var role in user.getRoleMappings()) roles.push(role.getName());
token.setOtherClaims("https://hasura.io/jwt/claims", {
    "x-hasura-user-id": user.getId(),
    "x-hasura-allowed-roles": Java.to(roles, "java.lang.String[]"),
    "x-hasura-default-role": "user",
});

Thats it, the next step is just to verify your settings

7. Go to clients -> your-client -> Scopes -> Evaluate
8. Select an user, and see the generated JWT payload in "Generated Access Token" Tab

Update: Keycloak has a new policy. they disable ScriptMappers by default You have to start the instance with this flag:

-Dkeycloak.profile.feature.upload_scripts=enabled

Update, since keycloak 7.0.1 Script Mapping is disabled by default, how to deploy scripts/enable read here:
https://www.keycloak.org/docs/latest/server_development/#_script_providers

THANK YOU!

@eduardosanzbBCG were you able to get this to work? Following that manual I created a deploy script jar file, Keycloak recognized it and deployed it, but I can't find it anywhere in the GUI.

Yes, but using docker image

keycloak:
--
  | image: quay.io/keycloak/keycloak:latest
  | command:
  | - "-Dkeycloak.profile.feature.upload_scripts=enabled"
  | environment:
  | DB_VENDOR: POSTGRES
  | DB_ADDR: postgres
  | DB_DATABASE: keycloak
  | DB_USER: keycloak
  | DB_SCHEMA: public
  | DB_PASSWORD: password
  | KEYCLOAK_USER: admin
  | KEYCLOAK_PASSWORD: Pa55w0rd
  | # Uncomment the line below if you want to specify JDBC parameters. The parameter below is just an example, and it shouldn't be used in production without knowledge. It is highly recommended that you read the PostgreSQL JDBC driver documentation in order to use it.
  | #JDBC_PARAMS: "ssl=true"
  | ports:
  | - 8080:8080
  | depends_on:
  | - postgres

@raarts when you deploy the script you can find it here:

Yes: this exactly was the reason, I did not add that flag:

"-Dkeycloak.profile.feature.upload_scripts=enabled"

So as I find the Keycloak documentation a bit confusing, if you go the JAR way you can have this in your META-INF/keycloak-scripts.json:

{
    "authenticators": [],
    "policies": [],
    "mappers": [
        {
            "name": "Hasura Mapper",
            "fileName": "hasura-mapper.js",
            "description": "Hasura Mapper from a JS file"
        }
    ]
}

and put in ./hasura-mapper.js the script from OP. Zip that folder and change the extension to a .jar, and if you use a docker-compose configuration, you can do it like this:

 keycloak:
    image: quay.io/keycloak/keycloak:latest
    command: -Dkeycloak.profile.feature.upload_scripts=enabled
    ...
    volumes:
      - type: bind
        source: ./hasura-keycloak.jar
        target: /opt/jboss/keycloak/standalone/deployments/hasura-keycloak.jar

I think -Dkeycloak.profile.feature.upload_scripts=enabled is still needed because of a bug, that they just didn't update yet.

Next you can add HASURA_GRAPHQL_JWT_SECRET: '{"jwk_url":"https://keycloakhost/auth/realms/xxRealmNamexx/protocol/openid-connect/certs"}' to your Hasura docker-compose.yaml as an environment variable.

Another Approach..

• Goto Mapper Menu
• Create Below 3 Mapper
  =================================================
  Protocol: openid-connect
  Name: hasura-claim-user-id
  Mapper Type: User Property
  Property: id
  Token Claim Name: https://hasura\.io/jwt/claims.x-hasura-user-id
  =================================================
  Protocol: openid-connect
  Name: hasura-claim-default-role
  Mapper Type: Hardcoded claim
  Token Claim Name: https://hasura\.io/jwt/claims.x-hasura-default-role
  Claim value: [Your Single Client Role]
  =================================================
  Protocol: openid-connect
  Name: hasura-claim-allowed-roles
  Client ID: [Your Hasura Client ID]
  Mapper Type: User Client Role
  Multivalued: On
  Token Claim Name: https://hasura\.io/jwt/claims.x-hasura-allowed-roles
  =================================================

@MegaCookie you are right. The initial gist was for keycloak 7 or so, and they have disabled scriptmappers in newer versions, you have to enable it manually -Dkeycloak.profile.feature.upload_scripts=enabled

@jaekook-neonesia actually a very good and simple approach, thank you for sharing this

@jaekook-neonesia very practical method. its working perfectly

Wonderfull ;) Now how can we sync our Keycloak users with Hasura.
In auth0 we can add a mutation script to replicate our users when they login/register in hasura.

How can we achieve this with keycloak ?

@ClementVanPeuter keycloak is open source so there are a lot of plugins, if you look for some sort of webhooks / events stuff. I haven't used any myself, just know that it should be possible.

Now how can we sync our Keycloak users with Hasura.

I would't at all. Just let the user sign-in and use your app, load the user by id, if not found, create the new user.

If someone wants to use composite roles (as I did) and wonders how to do so, here is my working script:

var roles = [];
for each (var role in user.getRoleMappings()) {
    if (role.isComposite()) {
        var composites = role.getComposites();
        var compositeRoleNames = [];
        for each (var composite in composites) {
            compositeRoleNames.push(composite.getName());
        }
        // push all composite role names to roles (equal to modern JS ...compositeNames)
        Array.prototype.push.apply(roles, compositeRoleNames);
    }
    // include role itself, not just possible composites
    roles.push(role.getName());
};

token.setOtherClaims("https://hasura.io/jwt/claims", {
    "x-hasura-user-id": user.getId(),
    "x-hasura-allowed-roles": Java.to(roles, "java.lang.String[]"),
    "x-hasura-default-role": "user",
});