JS-based policy option missing in Keycloak?

user_4049536 0
Viewed 1113

I'm trying to create a JS-based policy in Keycloak, and the documentation states:

To create a new JavaScript-based policy, select JavaScript in the dropdown list in the upper right corner of the policy listing.

but when I go to MyClient->Authorization->Policies and click the CreatePolicy dropdown in the top right corner, there is no "JS-based policy" alternative.

Am I missing something here? The only policy in the list is the Default Policy which is of type js, which also confuses me since that means JS-based policies should be available.

I'm running Keycloak 10.0.0, but I've also tried with version 9.0.3

keycloak
2 Answers

You need to enable scripting features: https://www.keycloak.org/docs/latest/server_installation/index.html#profiles

-Dkeycloak.profile.feature.scripts=enabled -Dkeycloak.profile.feature.upload_scripts=enabled

Then you will be able to play with Javascript in the Keycloak console. And yes, upload_scripts is deprecated feature, so keep it in the mind - you will need jar deployment for that in the future.

user_33486040

In the new version of Keycloak (>=18.0.0) you'll need to build the instance with "scripts" feature enabled.

I'm doing it with environment variable:

...
ENV KC_FEATURES=account-api,account2,authorization,client-policies,impersonation,docker,scripts,upload_scripts
RUN /opt/keycloak/bin/kc.sh build
...

My full Dockerfile to build the keycloak image, if someone interested:

FROM quay.io/keycloak/keycloak:18.0.0 as builder

ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_FEATURES=account-api,account2,authorization,client-policies,impersonation,docker,scripts,upload_scripts
ENV KC_DB=postgres
# Install custom providers
RUN curl -sL https://github.com/aerogear/keycloak-metrics-spi/releases/download/2.5.3/keycloak-metrics-spi-2.5.3.jar -o /opt/keycloak/providers/keycloak-metrics-spi-2.5.3.jar
RUN /opt/keycloak/bin/kc.sh build
USER root
RUN chown root:root -R /opt/keycloak

FROM quay.io/keycloak/keycloak:18.0.0
COPY --from=builder --chown=keycloak:root /opt/keycloak /opt/keycloak
WORKDIR /opt/keycloak
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "--verbose", "start", "--import-realm", "--http-relative-path=/auth"]

You can also pass features as parameter: --features=

[Update] Unfortunately, keycloak removed support for upload JS scripts from admin starting version 18. So, you'll need to deploy them as .jar(zip) files. It works, but makes the development and testing of JS modules slower.

See Enabled/Disable features documentation for more details.

user_22156790
Related