# Get current user id from Keycloak

**URL:** <https://forum.keycloak.org/t/get-current-user-id-from-keycloak/16692>\
**Category:** Getting advice\
**Created:** [July 30, 2022, 3:07pm UTC](https://forum.keycloak.org/t/get-current-user-id-from-keycloak/16692 "2022-07-30T15:07:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wb256](https://avatars.discourse-cdn.com/v4/letter/w/db5fbb/32.png) [@wb256](https://forum.keycloak.org/u/wb256)\
**Post date:** [July 30, 2022, 3:07pm UTC](https://forum.keycloak.org/t/get-current-user-id-from-keycloak/16692/1 "2022-07-30T15:07:01Z")

</div>

I’m running a java-based external webservice that needs to know the user id after the user calls its http endpoint.

Basically, there are 2 cases. The user might be logged in or not. My current vague idea to achieve this is:

1.) User is logged in:

- User clicks on link to the webservice.
- Webservice redirects to Keycloak
- Keycloak calls the webservice back with the userid

2.) User is not logged in:

- User clicks on link to the webservice
- Webservice redirects to Keycloak
- Keycloak performs login
- Redirect back to webservice with userid

What would be a way to achieve something similar to this? Ideally, this should be done via http redirects **without involving javascript**.

---

<div class="post-metadata">

**Author:** ![wb256](https://avatars.discourse-cdn.com/v4/letter/w/db5fbb/32.png) [@wb256](https://forum.keycloak.org/u/wb256)\
**Post date:** [July 30, 2022, 7:14pm UTC](https://forum.keycloak.org/t/get-current-user-id-from-keycloak/16692/2 "2022-07-30T19:14:01Z")

</div>

This turned out to be more complecated than I thought. Here is what I ended up doing:

- Use `spring-boot-starter-security` with `spring-boot-starter-oauth2-client`

Connect Keycloak:

```auto
spring:
  security:
    oauth2:
      client:
        registration:
          xxx-client:
            provider: keycloak
            client-id: ...
            client-secret: ...
            client-authentication-method: client_secret_basic
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
        provider:
          keycloak:
            issuer-uri: .../realms/<Realm>
            user-name-attribute: sub

```

And then protect the endpoint:

```auto
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
  http
    .authorizeRequests(authorizeRequests -> authorizeRequests
      .antMatchers("/payment/test").authenticated()
      .anyRequest().anonymous())
    .oauth2Client(Customizer.withDefaults())
    .oauth2Login(Customizer.withDefaults());
  return http.build();
}

```

This way the webservice will perform a couple of redirects to establish the user identity. In the end I can access the id this way:

```auto
@GetMapping("payment/test")
public String test(@AuthenticationPrincipal DefaultOAuth2User user) {
  return user.getName();
}

```

This requires 4 redirects just to establish the id. But at least it works.

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [July 30, 2022, 7:57pm UTC](https://forum.keycloak.org/t/get-current-user-id-from-keycloak/16692/3 "2022-07-30T19:57:58Z")

</div>

> [@wb256](#):
>
> This requires 4 redirects just to establish the id

If you think this is to complex, you might want to have a look into the OAuth2/OIDC protocol spec. It‘s all like designed, for good reasons. It‘ not just „login and give me an id“.

Possibly interesting for you:  
If you set the `scope` of your `client.registration….` to the value `openid` you‘ll get an `OidcUser` instead of an `OAuth2User` in your method as an authenticator principal. The `OidcUser` will give you more standard user profile information, as mentioned in the OIDC spec.