# Jwt authentication

**URL:** <https://discuss.hashicorp.com/t/jwt-authentication/31425>\
**Category:** Vault\
**Created:** [November 2, 2021, 5:16pm UTC](https://discuss.hashicorp.com/t/jwt-authentication/31425 "2021-11-02T17:16:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Masber](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/masber/32/13497_2.png) [@Masber](https://discuss.hashicorp.com/u/Masber)\
**Post date:** [November 2, 2021, 5:16pm UTC](https://discuss.hashicorp.com/t/jwt-authentication/31425/1 "2021-11-02T17:16:20Z")

</div>

Dear Vault community,

I am trying to integrate our vault test environment with a test keycloak installation. My goal is to authenticate to vault using a keycloak jwt token. I am not an expert on jwt authentication in general hence I may have had things mixed…

Steps to setup the environment below:

Create keycloak client

Enable jwt authentication in vault

```auto
vault auth enable -path=kc jwt

```

Setup the jwt auth method

```auto
vault write auth/kc/config \
    oidc_discovery_url="https://auth-tds.mydomain.local/auth/realms/xxx" \
    oidc_client_id="poc_auth" \
    oidc_client_secret="mysecret" \
    default_role="test"

```

Authenticate to keycloak to get token. Inspect the token for the sub, aud fields

Setup vault role

```auto
vault write auth/kc/role/test \
    role_type=jwt \
    bound_subject="97516847-fd75-4220-9d9c-0da0707f2200" \
    bound_audiences="account" \
    user_claim="aud" \
    policies="my-test-policy" \
    ttl=1h

```

Authenticate against vault using the keycloak jwt token generated in the previous step

```auto
vault write auth/kc/login role=test jwt=...

```

This last step gives me the following output:

```auto
Error writing data to auth/kc/login: Error making API request.

URL: PUT https://my-vault.local/v1/auth/kc/login
Code: 500. Errors:

* unhandled case during login

```

I would appreciate any insight of what am I doing wrong and how to move forward and be able to authenticate to vault using my keycloak jwt token.

thank you

---

<div class="post-metadata">

**Author:** ![jeffsanicola](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jeffsanicola/32/18651_2.png) [@jeffsanicola](https://discuss.hashicorp.com/u/jeffsanicola)\
**Post date:** [November 3, 2021, 12:34pm UTC](https://discuss.hashicorp.com/t/jwt-authentication/31425/2 "2021-11-03T12:34:10Z")

</div>

You seem to be mixing OIDC and JWT based logins with your config. Most other KeyCloak configs discussed in the forums here appear to be of the OIDC type.

Not sure if you’ve searched for similar issues but this thread might provide some insight for you: [Error Authenticating: Unable to authorize role OIDC - #4 by martinhristov90](https://discuss.hashicorp.com/t/error-authenticating-unable-to-authorize-role-oidc/11314/4)

---

<div class="post-metadata">

**Author:** ![Masber](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/masber/32/13497_2.png) [@Masber](https://discuss.hashicorp.com/u/Masber)\
**Post date:** [November 3, 2021, 3:08pm UTC](https://discuss.hashicorp.com/t/jwt-authentication/31425/3 "2021-11-03T15:08:06Z")

</div>

yes, you are right, the jwt authentication method configuration was simpler to what I was doing:

this worked for me

```auto
vault write auth/kc/config \
    oidc_discovery_url="https://auth-tds.mydomain.local/auth/realms/xxx" \
    bound_issuer="https://auth-tds.mydomain.local/auth/realms/xxx" \
    default_role="test"

```