# JWT Authentication and ACLs

**URL:** <https://discuss.hashicorp.com/t/jwt-authentication-and-acls/12915>\
**Category:** Consul\
**Created:** [August 16, 2020, 7:24pm UTC](https://discuss.hashicorp.com/t/jwt-authentication-and-acls/12915 "2020-08-16T19:24:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![opsngine-io](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/opsngine-io/32/10605_2.png) [@opsngine-io](https://discuss.hashicorp.com/u/opsngine-io)\
**Post date:** [August 16, 2020, 7:24pm UTC](https://discuss.hashicorp.com/t/jwt-authentication-and-acls/12915/1 "2020-08-16T19:24:09Z")

</div>

Hi,

I am trying to integrate consul with keycloak and use jwt tokens to write to KV store.  
I created auth-method as follows:

```json
{
  "Name": "keycloak",
  "Type": "jwt",
  "Description": "keycloak auth server",
  "Config": {
    "BoundAudiences": [
      "broker",
      "account"
    ],
    "JWKSURL": "https://keycloack/auth/realms/matrix/protocol/openid-connect/certs",
    "ClaimMappings": {
      "given_name": "first_name",
      "family_name": "last_name",
      "azp": "azp",
      "matrix_role": "matrix_role"
    },
    "ListClaimMappings": {
      "groups": "groups"
    }
  }
}

```

Also created binding:

```json
{
  "Description": "my-api binding",
  "AuthMethod": "keycloak",
  "Selector": "value.name!=vault",
  "BindType": "role",
  "BindName": "matrix-apis-test"
}

```

Created a matrix-apis-test role and policy

```json
{
  "key_prefix": {
    "": {
      "policy": "read"
    },
    "matrix-api/": {
      "policy": "write"
    },
    "foo/private/": {
      "policy": "deny"
    }
  },
  "key": {
    "foo/bar/secret": {
      "policy": "deny"
    }
  }
}

```

When trying to write to matrix-api/registry/test

```nohighlight
 [ERROR] agent.http: Request error: method=PUT url=/v1/kv/matrix-api/registry/test?dc=dc-1&flags=3304740253564472344 error="ACL not found"

```

Am I missing something?

I am running latest 1.8.3 version with acl enabled

---

<div class="post-metadata">

**Author:** ![blake](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/blake/32/27620_2.png) [@blake](https://discuss.hashicorp.com/u/blake)\
**Post date:** [August 16, 2020, 9:33pm UTC](https://discuss.hashicorp.com/t/jwt-authentication-and-acls/12915/2 "2020-08-16T21:33:23Z")

</div>

Hi @opsngine-io,

It looks like your binding rule is incorrect. The rule should attempt to match on one of the fields you’ve mapped in either `ClaimMappings` or `ListClaimMappings`, such as `first_name`. For example,

```json
{
    "Description": "my-api binding",
    "AuthMethod": "keycloak",
    "Selector": "value.first_name!=vault",
    "BindType": "role",
    "BindName": "matrix-apis-test"
}

```

Can you execute `consul acl token read -self` and check whether the token you’re being issued has the matrix-apis-test role associated to it? If it does not have that role, try updating your binding rule’s selector to match on a value that you’ve mapped using `ClaimMappings`.

---

<div class="post-metadata">

**Author:** ![opsngine-io](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/opsngine-io/32/10605_2.png) [@opsngine-io](https://discuss.hashicorp.com/u/opsngine-io)\
**Post date:** [August 17, 2020, 4:28am UTC](https://discuss.hashicorp.com/t/jwt-authentication-and-acls/12915/3 "2020-08-17T04:28:50Z")

</div>

Thanks for replying,

My idea was that this binding would match anything coming from auth-method.

Anyway, I corrected it as you suggested. Now trying to login with

```
consul login -method 'keycloak' -token-sink-file 'consul.token' -bearer-token-file jwt-token

```

And getting an error:

```
Error logging in: Unexpected response code: 500 (computed "role" bind name for bind target is invalid: "")

```

I double checked and there is **matrix-apis-test** role. Not sure what else to check.

Thanks