Configure RPT token exchange and permission-based authorization for affolterNET.Web.Bff. Use when setting up Keycloak permissions, resource policies, or fine-grained access control.
Configures Keycloak RPT token exchange for fine-grained authorization. Use when setting up permission-based access control where BFF exchanges access tokens for RPTs containing specific resource permissions.
/plugin marketplace add Mcafee123/affolterNET.Web/plugin install affolternet-web-bff@affolternet-webThis skill inherits all available tools. When active, it can use any tool Claude has access to.
Configure Keycloak RPT-based permission authorization.
For complete reference, see Library Guide.
RPT (Requesting Party Token) enables fine-grained permissions:
var options = builder.Services.AddBffServices(isDev, config, opts => {
opts.ConfigureBff = bff => {
bff.AuthMode = AuthenticationMode.Authorize;
};
});
[Authorize(Policy = "admin-resource")]
[HttpGet("admin")]
public IActionResult AdminOnly() => Ok();
// Multiple permissions (any match)
[Authorize(Policy = "admin-resource,manager-resource")]
[HttpGet("management")]
public IActionResult Management() => Ok();
{
"permissions": [
{
"rsname": "admin-resource",
"scopes": ["view", "manage"]
},
{
"rsname": "user-resource",
"scopes": ["read", "create"]
}
]
}
// Single permission
[RequirePermission("admin-resource:view")]
public IActionResult AdminView() { ... }
// Multiple permissions (any match)
[RequirePermission("admin-resource:manage", "user-resource:delete")]
public IActionResult AdminManage() { ... }
// Single permission
[Authorize(Policy = "admin-resource:view")]
public IActionResult AdminView() { ... }
// Multiple permissions (comma-separated)
[Authorize(Policy = "admin-resource:manage,user-resource:delete")]
public IActionResult AdminManage() { ... }
Note: RequirePermission is a convenience wrapper that sets the Policy internally.
public class MyController : ControllerBase
{
public IActionResult ConditionalAction()
{
var permissions = User.FindAll("permission")
.Select(c => c.Value);
if (permissions.Contains("admin-resource:manage"))
{
// Admin-specific logic
}
return Ok();
}
}
// Auth store
const useAuthStore = defineStore('auth', {
state: () => ({
permissions: [] as { resource: string; action: string }[]
}),
actions: {
hasPermission(resource: string, action: string): boolean {
return this.permissions.some(
p => p.resource === resource && p.action === action
);
}
}
});
// Component usage
<template>
<button v-if="authStore.hasPermission('admin-resource', 'manage')">
Admin Action
</button>
</template>
When the RPT middleware processes permissions, it adds claims to the user identity:
| Property | Value |
|---|---|
| Claim Type | "permission" |
| Claim Value | "{resource}:{scope}" |
Examples: "admin-resource:view", "user-resource:create"
RPT tokens are cached per user to avoid repeated Keycloak calls:
{
"affolterNET": {
"Web": {
"PermissionCache": {
"ExpirationMinutes": 5
}
}
}
}
AuthMode is AuthorizeConfigure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.