Configure JWT Bearer authentication with Keycloak for affolterNET.Web.Api. Use when setting up token validation, Keycloak integration, or API authentication.
Configures JWT Bearer authentication with Keycloak for affolterNET.Web.Api. Use this when setting up token validation, integrating with Keycloak, or implementing API authentication with support for both basic JWT validation and permission-based authorization.
/plugin marketplace add Mcafee123/affolterNET.Web/plugin install affolternet-web-api@affolternet-webThis skill inherits all available tools. When active, it can use any tool Claude has access to.
Configure JWT Bearer authentication with Keycloak integration.
For complete reference, see Library Guide.
{
"affolterNET": {
"Web": {
"Auth": {
"Provider": {
"Authority": "https://keycloak.example.com/realms/myrealm",
"ClientId": "my-api-client",
"ClientSecret": "your-client-secret"
}
}
}
}
}
var options = builder.Services.AddApiServices(isDev, builder.Configuration, opts => {
opts.ConfigureApi = api => {
api.AuthMode = AuthenticationMode.Authenticate;
};
});
| Mode | Description |
|---|---|
None | No authentication required |
Authenticate | Valid JWT required, no permission checks |
Authorize | Valid JWT + Keycloak RPT permissions required |
| Property | Description |
|---|---|
Authority | Keycloak realm URL |
ClientId | OIDC client identifier |
ClientSecret | OIDC client secret |
Audience | Expected JWT audience (optional) |
When using AuthenticationMode.Authorize:
[Authorize(Policy = "admin-resource")]
[HttpGet("admin")]
public IActionResult AdminOnly() { ... }
// Multiple permissions (comma-separated, any match)
[Authorize(Policy = "resource1,resource2")]
[HttpGet("multi")]
public IActionResult MultiPermission() { ... }
The API automatically enriches claims with:
ClaimTypes.Role and "roles" claimsAuthority URL is correct and accessibleClientId matches the Keycloak clientAuthMode is set to AuthorizeConfigure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.