# Kong and Keycloak JWT

**URL:** <https://discuss.konghq.com/t/kong-and-keycloak-jwt/2228>\
**Category:** General\
**Created:** [November 7, 2018, 3:17am UTC](https://discuss.konghq.com/t/kong-and-keycloak-jwt/2228 "2018-11-07T03:17:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pmb](https://avatars.discourse-cdn.com/v4/letter/p/a5b964/32.png) [@pmb](https://discuss.konghq.com/u/pmb)\
**Post date:** [November 7, 2018, 3:17am UTC](https://discuss.konghq.com/t/kong-and-keycloak-jwt/2228/1 "2018-11-07T03:17:33Z")

</div>

We have been evaluating Kong for fronting our APIs and so far its been great.

Need some pointers on making Kong work with Keycloak. The authentication with a JWT is working fine.

Keycloak sends a ream\_access attribute which is based on a LDAP group membership. For example;

“resource\_access”: {  
“account”: {  
“roles”: [  
“team-1”,  
“team-2”,  
“team-3”  
]  
}  
}

Is there a way for Kong to read these attributes from the JWT token and allow/deny access to an API?

Thanks.

---

<div class="post-metadata">

**Author:** ![Stefan\_Badenhorst](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@Stefan\_Badenhorst](https://discuss.konghq.com/u/Stefan_Badenhorst)\
**Post date:** [November 12, 2018, 4:09pm UTC](https://discuss.konghq.com/t/kong-and-keycloak-jwt/2228/2 "2018-11-12T16:09:53Z")

</div>

We had a related use case, were we needed to get the user login id from the JWT and pass it to the API.  
We made a small change to the JWT plugin to do this.  
Your use case should be kind of similar and if not maybe the code will help you anyway.

There is a down side to doing this. Because the plugin is not in a separate project, you have to fork and modify the main king project.

You can find the code here:

> **[maudrid/kong](https://github.com/maudrid/kong)**
>
> :monkey: The Microservice API Gateway. Contribute to maudrid/kong development by creating an account on GitHub.

Pull Request:

> <https://github.com/Kong/kong/pull/3491>

Hope this helps.

---

<div class="post-metadata">

**Author:** ![pmb](https://avatars.discourse-cdn.com/v4/letter/p/a5b964/32.png) [@pmb](https://discuss.konghq.com/u/pmb)\
**Post date:** [November 12, 2018, 10:30pm UTC](https://discuss.konghq.com/t/kong-and-keycloak-jwt/2228/3 "2018-11-12T22:30:19Z")

</div>

Thank you. Will take a look at this.

---

<div class="post-metadata">

**Author:** ![jerney](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jerney/32/535_2.png) [@jerney](https://discuss.konghq.com/u/jerney)\
**Post date:** [November 20, 2018, 2:35pm UTC](https://discuss.konghq.com/t/kong-and-keycloak-jwt/2228/4 "2018-11-20T14:35:57Z")

</div>

Fairly certain it would be possible to modify the Kong OIDC plugin to do this. That will get you away from having to fork Kong.