<\/div>\n

Merhaba,<\/p>\n

Bu i\u00e7eri\u011fimizde; Keycloak platformunda kullan\u0131c\u0131 y\u00f6netimiyle ilgili s\u0131k kar\u015f\u0131la\u015f\u0131lan ancak genellikle y\u00fczeysel ge\u00e7ilen baz\u0131 ek senaryolara odaklan\u0131yor olaca\u011f\u0131z. Bu senaryolar; Keycloak’\u0131n varsay\u0131lan olarak sundu\u011fu kullan\u0131c\u0131 bilgilerine nas\u0131l ek alanlar eklenebilece\u011fi, kullan\u0131c\u0131lara ge\u00e7ici veya kal\u0131c\u0131 \u015fifrenin nas\u0131l tan\u0131mlanabilece\u011fi, Password Grant Type<\/a> \u00fczerinden kullan\u0131c\u0131 do\u011frulaman\u0131n nas\u0131l yap\u0131labilece\u011fi ve aktif oturum (session) bilgilerine nas\u0131l eri\u015filebilece\u011fi gibi s\u00fcre\u00e7leri kapsamaktad\u0131r… Ayr\u0131ca, bu s\u00fcre\u00e7ler s\u0131ras\u0131nda elde edilen token’lar\u0131 \u00e7\u00f6z\u00fcmleyerek detayl\u0131 bir \u015fekilde inceleyecek; token i\u00e7eri\u011fi \u00fczerinden userinfo endpoint’ine eri\u015ferek kullan\u0131c\u0131 bilgilerini nas\u0131l g\u00f6zlemleyebilece\u011fimizi de ele al\u0131yor olaca\u011f\u0131z. O halde haz\u0131rsan\u0131z ba\u015flayal\u0131m…<\/p>\n

Ba\u015fl\u0131klar<\/p>\n Toggle<\/span>

Client Credentials \u0130le Client’\u0131 Yetkilendirme<\/a><\/li>
Varsay\u0131lan Olarak Sunulan Kullan\u0131c\u0131 Bilgilerine Ek Alan (Attribute) Ekleme<\/a><\/li>
Kullan\u0131c\u0131ya Ge\u00e7ici (Temporary) ve Kal\u0131c\u0131 (Permanent) \u015eifre Tan\u0131mlama<\/a><\/li>
Password Grant Type \u0130le Kullan\u0131c\u0131y\u0131 Do\u011frulama<\/a><\/li>
Kullan\u0131c\u0131n\u0131n Aktif Oturum (Session) Bilgilerine Eri\u015fme<\/a><\/li>
Access Token’\u0131 \u00c7\u00f6z\u00fcmleyelim<\/a><\/li>
UserInfo Endpoint ile Kullan\u0131c\u0131 Bilgilerine Eri\u015fim<\/a><\/li><\/ul><\/nav><\/div>\n
<\/span>Client Credentials \u0130le Client’\u0131 Yetkilendirme<\/span><\/h5>\n
T\u00fcm \u00e7al\u0131\u015fma s\u00fcrecinde kullanaca\u011f\u0131m\u0131z token, Asp.NET Core \u0130le REST API \u00dczerinden Temel Keycloak \u0130\u015flemleri #3<\/a> ba\u015fl\u0131kl\u0131 yaz\u0131m\u0131z\u0131n ‘Client Credentials \u0130le Access Token Alma’<\/em> ba\u015fl\u0131\u011f\u0131 alt\u0131nda client credentials<\/a> yakla\u015f\u0131m\u0131yla edindi\u011fimiz access token olacakt\u0131r. \u0130lgili \u00e7al\u0131\u015fmaya, i\u00e7eri\u011fimizin en sonunda verece\u011fimiz GitHub adresindeki projeden eri\u015febilir ve kullan\u0131m sa\u011flayabilirsiniz.<\/p>\n
<\/span>Varsay\u0131lan Olarak Sunulan Kullan\u0131c\u0131 Bilgilerine Ek Alan (Attribute) Ekleme<\/span><\/h5>\n
Keycloak’da bir kullan\u0131c\u0131 i\u00e7in varsay\u0131lan olarak Username<\/em>, Email<\/em>, First Name<\/em> ve Last Name<\/em> bilgileri sunulmaktad\u0131r. Bunlarla birlikte, bu alanlara ek olarak ihtiya\u00e7 do\u011frultusunda \u00f6zel (custom) alanlar tan\u0131mlamak da m\u00fcmk\u00fcnd\u00fcr. Bunun i\u00e7in yap\u0131lmas\u0131 gereken a\u015fa\u011f\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcnde oldu\u011fu gibi ilgili realm \u00fczerinden Realm settings<\/em> \u2794 User profile<\/em> \u2794 Create attribute<\/em><\/span> kombinasyonunu takip etmektir. $\"Keycloak'da$ <\/a>Evet, Keycloak’da kullan\u0131c\u0131lara tan\u0131mlanan ek alanlara attribute denmektedir! Bir ba\u015fka deyi\u015fle, Keycloak’da standart alanlar\u0131n d\u0131\u015f\u0131ndaki her \u015feye \/ bilgiye kar\u015f\u0131l\u0131k gelen tan\u0131mlara attribute denmektedir. Bu kullan\u0131c\u0131larda firstName<\/em>, lastName<\/em> vs. gibi ekstradan alanlar olabilece\u011fi gibi bir realm’ler de genel konfig\u00fcrasyon ama\u00e7l\u0131 veya client’larda da \u00f6zel metadata tan\u0131mlama ama\u00e7l\u0131 alanlar olabilmektedir.<\/p>\n
Keycloak’da attribute; standart alanlar\u0131n d\u0131\u015f\u0131nda her \u015feye \/ bilgiye kar\u015f\u0131l\u0131k gelen tan\u0131mlard\u0131r.<\/em><\/p><\/blockquote>\n
Bir attribute tan\u0131mlarken a\u015fa\u011f\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcnde olan alanlar\u0131n doldurulmas\u0131 gerekmektedir: $\"\"$ <\/a>Burada a\u015fikar olanlar\u0131n d\u0131\u015f\u0131nda g\u00f6ze \u00e7arpan alanlar\u0131 izah etmekte fayda g\u00f6rmekteyim;<\/p>\n
\n
Multivalued<\/u><\/em> : Tan\u0131mlanacak bu alanda birden fazla de\u011fer al\u0131nacaksa i\u015faretlenmelidir. \u0130\u015faretlendi\u011fi taktirde ilgili attribute bir array’e d\u00f6n\u00fc\u015fecektir.<\/li>\n
Attribute group<\/u><\/em> : Bu alan\u0131n profil ekran\u0131nda hangi ba\u015fl\u0131k alt\u0131nda g\u00f6r\u00fcnece\u011fini belirtir.<\/li>\n
Enabled when<\/u><\/em> : Bu attribute’un ne zaman devreye (yani token’a) girece\u011fi belirlenir. Attribute her kullan\u0131c\u0131da m\u0131 \u00e7al\u0131\u015fs\u0131n, yoksa sadece istenirse mi \u00e7al\u0131\u015fs\u0131n?<\/em> ayar\u0131n\u0131 ger\u00e7ekle\u015ftirmemizi sa\u011flar. E\u011fer Always<\/em> denirse, attribute her zaman aktif olacak ve token’a ko\u015fulsuz girecektir. Yok e\u011fer Scope are requested<\/em> se\u00e7ilirse attribute ancak ilgili scope istendi\u011fi taktirde aktif olacak ve istenmedi\u011fi taktirde token’a girmeyecektir.
\nBu ayar\u0131n amac\u0131, token’\u0131n gereksiz yere \u015fi\u015fmesini ve bir yandan da veri if\u015fas\u0131n\u0131 \u00f6nlemektir.<\/li>\n
Required field<\/u><\/em> : Kullan\u0131c\u0131 login ya da register olurken bu alan\u0131n dolu olmas\u0131n\u0131n zorunlu olup olmamas\u0131n\u0131 ayarlar. Mesela, sonraki ad\u0131mlarda bahsi ge\u00e7ece\u011fi \u00fczere bir kullan\u0131c\u0131n\u0131n firstname<\/em> ve lastname<\/em> alanlar\u0131 bo\u015fsa e\u011fer login olunamayaca\u011f\u0131 durumu i\u015fte bu ayarla ili\u015fkilidir.<\/li>\n
Permission<\/u><\/em> : Alanla ilgili yetkilerin ayarland\u0131\u011f\u0131 b\u00f6l\u00fcmd\u00fcr:\n\n
Who can edit?<\/em> Bu alan\u0131;
\nUser \u2794 Kullan\u0131c\u0131 kendisi de\u011fi\u015ftirebilir.
\nAdmin \u2794 Sadece admin de\u011fi\u015ftirebilir.\n<\/li>\n
Who can view?<\/em> Bu alan\u0131;
\nUser \u2794 Kullan\u0131c\u0131 g\u00f6rebilir.
\nAdmin \u2794 Admin g\u00f6rebilir.\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
\u00d6rne\u011fin phone-number ad\u0131nda a\u015fa\u011f\u0131daki gibi bir attribute olu\u015ftural\u0131m. $\"\"$ <\/a>Tabi bu de\u011ferin bir telefon numaras\u0131 olup olmad\u0131\u011f\u0131n\u0131 kontrol edebilmek i\u00e7in bir validation tan\u0131mlamam\u0131z gerekmektedir. Bunu da a\u015fa\u011f\u0131daki g\u00f6rselde oldu\u011fu gibi Validations<\/em> alan\u0131ndan ekleyebiliriz: $\"Keycloak'da$ <\/a>E\u011fer ki bu validation’a uygun veri girilmezse Keycloak a\u015fa\u011f\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcnde oldu\u011fu gibi belirtilen error message’\u0131 d\u00f6nd\u00fcrecektir: $\"Keycloak'da$ <\/a>Velhas\u0131l, attribute sa\u011f salim tan\u0131mlanabildiyse e\u011fer kullan\u0131c\u0131 detaylar\u0131nda a\u015fa\u011f\u0131daki gibi g\u00f6z\u00fck\u00fcyor olacakt\u0131r: $\"Keycloak'da$ <\/a>Peki t\u00fcm bu i\u015flemi Administration REST API \u00fczerinden nas\u0131l ger\u00e7ekle\u015ftirebiliriz?<\/strong>
\nEvet, Keycloak’ta kullan\u0131c\u0131 bilgilerine ekstra alan eklemek aray\u00fczden olduk\u00e7a rahat. Ancak mevzu bahis programatik olarak bu i\u015fi ger\u00e7ekle\u015ftirmekse birazc\u0131k s\u00fcreci a\u015fa\u011f\u0131daki gibi detaya indirgememiz gerekmektedir:<\/p>\n
\n
\r\napp.MapPost("\/realm\/{realm}\/configure-user-attributes", async (string realm, TokenRequestService tokenRequestService, IHttpClientFactory httpClientFactory, RealmAttributeConfigRequest request) =>\r\n{\r\n var token = await tokenRequestService.GetAccessTokenAsync();\r\n using var httpClient = httpClientFactory.CreateClient("keycloak");\r\n\r\n httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token.AccessToken);\r\n\r\n \/\/ 1. Mevcut User Profile yap\u0131land\u0131rmas\u0131n\u0131 al\r\n var getProfileResponse = await httpClient.GetAsync($"\/admin\/realms\/{realm}\/users\/profile");\r\n\r\n if (!getProfileResponse.IsSuccessStatusCode)\r\n return Results.BadRequest(new { error = "User Profile yap\u0131land\u0131rmas\u0131 al\u0131namad\u0131!" });\r\n\r\n var profileContent = await getProfileResponse.Content.ReadAsStringAsync();\r\n var existingProfile = JsonSerializer.Deserialize<JsonElement>(profileContent);\r\n\r\n \/\/ 2. Mevcut attributes listesini al\r\n List<object> attributesList = null;\r\n\r\n if (existingProfile.TryGetProperty("attributes", out var attributesElement))\r\n attributesList = attributesElement\r\n .EnumerateArray()\r\n .Select(attr => JsonSerializer.Deserialize<object>(attr.GetRawText()))\r\n .OfType<object>()\r\n .ToList();\r\n\r\n \/\/ 3. Yeni attribute'lar\u0131 ekle\r\n request.NewAttributes.ForEach(newAttribute =>\r\n {\r\n \/\/ Validation objesini olu\u015ftur\r\n var validations = new Dictionary<string, object>();\r\n\r\n if (newAttribute.Validations is not null)\r\n newAttribute.Validations.ForEach(validation =>\r\n {\r\n validations[validation.Type.ToLower()] = validation.Type.ToLower() switch\r\n {\r\n "length" => new { min = validation.Min, max = validation.Max },\r\n "email" => new { },\r\n "pattern" => new { pattern = validation.Pattern, errorMessage = validation.ErrorMessage ?? "Ge\u00e7ersiz format" },\r\n "options" => new { options = validation.Options },\r\n "uri" => new { },\r\n "integer" => new { min = validation.Min, max = validation.Max },\r\n "number" => new { min = validation.Min, max = validation.Max }\r\n };\r\n });\r\n\r\n var attributeConfig = new Dictionary<string, object>\r\n {\r\n ["name"] = newAttribute.Name,\r\n ["displayName"] = newAttribute.DisplayName ?? newAttribute.Name,\r\n ["validations"] = validations,\r\n ["permissions"] = new\r\n {\r\n view = new[] { "admin", "user" },\r\n edit = new[] { "admin", "user" }\r\n },\r\n ["multivalued"] = newAttribute.Multivalued\r\n };\r\n\r\n \/\/ Required sadece true oldu\u011funda ekle\r\n if (newAttribute.Required)\r\n attributeConfig["required"] = new\r\n {\r\n roles = new[] { "user" }\r\n };\r\n\r\n attributesList!.Add(attributeConfig);\r\n });\r\n\r\n \/\/ 4. G\u00fcncellenmi\u015f profile yap\u0131land\u0131rmas\u0131n\u0131 haz\u0131rla\r\n var updatedProfile = new\r\n {\r\n attributes = attributesList,\r\n groups = existingProfile.TryGetProperty("groups", out var groups) ? JsonSerializer.Deserialize<object>(groups.GetRawText()) : new { }\r\n };\r\n\r\n var updateJson = JsonSerializer.Serialize(updatedProfile);\r\n var updateRequest = new StringContent(updateJson, Encoding.UTF8, MediaTypeNames.Application.Json);\r\n\r\n \/\/ 5. User Profile'\u0131 g\u00fcncelle\r\n var updateResponse = await httpClient.PutAsync($"\/admin\/realms\/{realm}\/users\/profile", updateRequest);\r\n\r\n if (updateResponse.IsSuccessStatusCode)\r\n return Results.Ok(new { message = $"Realm seviyesinde {request.NewAttributes.Count} adet yeni attribute ba\u015far\u0131yla tan\u0131mland\u0131!" });\r\n\r\n var errorContent = await updateResponse.Content.ReadAsStringAsync();\r\n return Results.BadRequest(new { error = errorContent });\r\n});\r\n<\/pre>\n<\/div>\n
Burada dikkat edilmesi gereken husus \u015fudur ki; attribute’larla ilgili bir \u00e7al\u0131\u015fma yap\u0131yorsak e\u011fer \u00f6nceki attribute’lar\u0131n hepsini elde edip o \u015fekilde \u00e7al\u0131\u015fma sergilenmesi gerekti\u011fidir. Haliyle bu mant\u0131kla yukar\u0131daki kodu de\u011ferlendirdi\u011fimizde 9<\/em> ile 25.<\/em> sat\u0131r aral\u0131\u011f\u0131nda mevcut User Profile<\/em> yap\u0131land\u0131rmas\u0131 elde edilmekte ve 28<\/em> ile 69.<\/em> sat\u0131r aral\u0131\u011f\u0131nda bu mevcut attribute’larla birlikte yenileri eklenerek Keycloak’a g\u00f6nderilmektedir…<\/p>\n
31<\/em> ile 46.<\/em> sat\u0131rda ise yeni eklenen attribute’un varsa validation davran\u0131\u015f\u0131 tespit edilmekte ve 48<\/em> ile 68.<\/em> sat\u0131r aral\u0131\u011f\u0131nda ise bu attribute’da (varsa) validation ayarlar\u0131 ile birlikte mevcut attribute’lar\u0131n aras\u0131na eklenerek Keycloak’a g\u00f6nderilmeye haz\u0131r bir hale gelinmektedir.<\/p>\n
72<\/em> ile 76.<\/em> sat\u0131r aral\u0131\u011f\u0131nda ise User Profile<\/em>‘\u0131 g\u00fcncelleyecek formatta (i\u00e7erisinde attribute’lar\u0131n en son hali ve group bilgisi e\u015fli\u011finde)<\/span> nesne haz\u0131rlanmakta ve 82.<\/em> sat\u0131rda bu nesne \/admin\/realms\/{realm}\/users\/profile<\/code> endpoint’ine g\u00f6nderilerek t\u00fcm \u00e7al\u0131\u015fma ba\u015far\u0131yla nihayete erdirilmektedir.<\/p>\n
\u0130\u015fte biraz \u00f6nce aray\u00fcz \u00fczerinden yapt\u0131\u011f\u0131m\u0131z yap\u0131land\u0131rman\u0131n kodsal kar\u015f\u0131l\u0131\u011f\u0131 birebir bu \u015fekildedir. Tabi burada permissions<\/em> yap\u0131land\u0131rmas\u0131n\u0131 da client’tan bekleyebilir ve daha opsiyonel bir hale getirebiliriz. Buras\u0131n\u0131 sabit de\u011ferlerle b\u0131rak\u0131yor ve gerisini sizlere b\u0131rak\u0131yorum art\u0131k…<\/p>\n
Bu endpoint’te beklenen body a\u015fa\u011f\u0131daki gibi olacakt\u0131r:<\/p>\n
\n
\r\n{\r\n "newAttributes": [\r\n {\r\n "name": "phone-number",\r\n "displayName": "Phone Number",\r\n "multivalued": false,\r\n "required": false,\r\n "validations": [\r\n {\r\n "type": "pattern",\r\n "pattern": "^0\\\\s\\\$[5][0-9]{2}\\\$\\\\s[0-9]{3}\\\\s[0-9]{2}\\\\s[0-9]{2}$",\r\n "errorMessage": "L\u00fctfen telefon numaras\u0131n\u0131 do\u011fru giriniz.",\r\n "options": [\r\n ""\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n<\/pre>\n<\/div>\n
Peki bir kullan\u0131c\u0131daki attribute de\u011ferini nas\u0131l de\u011fi\u015ftirebiliriz?<\/strong>
\nBunun i\u00e7in de yap\u0131lmas\u0131 gereken \u00f6nce kullan\u0131c\u0131y\u0131 elde edip, yine mevcut attribute’lar\u0131 e\u015fli\u011finde, g\u00fcncellenecek attribute de\u011ferini g\u00f6ndermek…<\/p>\n
\n
\r\napp.MapPut("\/user\/{userId}\/add-new-attribute\/{realm}", async (string userId, string realm, TokenRequestService tokenRequestService, IHttpClientFactory httpClientFactory, AddAttributeRequest request) =>\r\n{\r\n var token = await tokenRequestService.GetAccessTokenAsync();\r\n using var httpClient = httpClientFactory.CreateClient("keycloak");\r\n\r\n httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token.AccessToken);\r\n\r\n \/\/ 1. Mevcut kullan\u0131c\u0131y\u0131 GET ile \u00e7ek\r\n var getUserResponse = await httpClient.GetAsync($"\/admin\/realms\/{realm}\/users\/{userId}");\r\n\r\n if (!getUserResponse.IsSuccessStatusCode)\r\n return Results.NotFound(new { error = "Kullan\u0131c\u0131 bulunamad\u0131!" });\r\n\r\n var userContent = await getUserResponse.Content.ReadAsStringAsync();\r\n var existingUser = JsonSerializer.Deserialize<JsonElement>(userContent);\r\n\r\n \/\/ 2. Mevcut attributes'lar\u0131 al\r\n var existingAttributes = new Dictionary<string, List<string>>();\r\n\r\n if (existingUser.TryGetProperty("attributes", out var attributesElement))\r\n attributesElement\r\n .EnumerateObject()\r\n .Select(attribute => existingAttributes[attribute.Name] = attribute.Value\r\n .EnumerateArray()\r\n .Select(v => v.GetString() ?? string.Empty)\r\n .ToList());\r\n\r\n \/\/ 3. Yeni attribute'lar\u0131 mevcut olanlara ekle\r\n request.NewAttributes.ToList().ForEach(newAttribute => existingAttributes[newAttribute.Key] = newAttribute.Value);\r\n\r\n \/\/ 4. Kullan\u0131c\u0131y\u0131 g\u00fcncelle (t\u00fcm attributes ile birlikte)\r\n var updateUser = new\r\n {\r\n firstName = existingUser.GetProperty("firstName").GetString(),\r\n lastName = existingUser.GetProperty("lastName").GetString(),\r\n email = existingUser.GetProperty("email").GetString(),\r\n enabled = existingUser.GetProperty("enabled").GetBoolean(),\r\n attributes = existingAttributes\r\n };\r\n\r\n var updateJson = JsonSerializer.Serialize(updateUser);\r\n var updateRequest = new StringContent(updateJson, Encoding.UTF8, MediaTypeNames.Application.Json);\r\n\r\n var updateResponse = await httpClient.PutAsync($"\/admin\/realms\/{realm}\/users\/{userId}", updateRequest);\r\n\r\n if (updateResponse.IsSuccessStatusCode)\r\n return Results.Ok(new { message = "Yeni attribute'lar ba\u015far\u0131yla eklendi, mevcut olanlar korundu!" });\r\n\r\n var errorContent = await updateResponse.Content.ReadAsStringAsync();\r\n return Results.BadRequest(new { error = errorContent });\r\n});\r\n<\/pre>\n<\/div>\n
Kodu incelerseniz e\u011fer; 18<\/em> ile 26.<\/em> sat\u0131r aral\u0131\u011f\u0131nda mevcut t\u00fcm attribute’lar \u00e7ekilmekte, 29.<\/em> sat\u0131rda ise g\u00fcncellenen attribute’lar body’den ay\u0131klanarak mevcutlar\u0131n de\u011ferleriyle de\u011fi\u015ftirilmektedir. Ard\u0131ndan 32<\/em> ile 39.<\/em> sat\u0131r aral\u0131\u011f\u0131nda mevcut olanlarla birlikte t\u00fcm attribute’lar en g\u00fcncel halleriyle nesneye d\u00f6n\u00fc\u015ft\u00fcr\u00fclmekte ve 44.<\/em> sat\u0131rda da \/admin\/realms\/{realm}\/users\/{userId}<\/code> endpoint’ine g\u00f6nderilerek g\u00fcncelleme sa\u011flanmaktad\u0131r.<\/p>\n
Bu attribute g\u00fcncelleme s\u00fcrecinde de body a\u015fa\u011f\u0131daki gibi olacakt\u0131r:<\/p>\n
\n\r\n{\r\n "newAttributes": {\r\n "phone-number": [\r\n "0 (507) 751 45 93"\r\n ]\r\n }\r\n}\r\n<\/pre>\n<\/div>\nPeki bir kullan\u0131c\u0131 eklenirken attribute de\u011ferleriyle birlikte nas\u0131l eklenebilir?<\/strong> \nMant\u0131k ayn\u0131:<\/p>\n\n\r\napp.MapPost("\/user\/add-attributes\/{realm}", async (string realm, TokenRequestService tokenRequestService, IHttpClientFactory httpClientFactory, UserRequest request) =>\r\n{\r\n var token = await tokenRequestService.GetAccessTokenAsync();\r\n using var httpClient = httpClientFactory.CreateClient("keycloak");\r\n\r\n var user = new\r\n {\r\n username = request.Username,\r\n email = request.Email,\r\n enabled = request.Enabled,\r\n firstName = request.FirstName,\r\n lastName = request.LastName,\r\n attributes = request.CustomAttributes\r\n };\r\n\r\n var userJson = JsonSerializer.Serialize(user);\r\n var userRequest = new StringContent(userJson, Encoding.UTF8, MediaTypeNames.Application.Json);\r\n\r\n httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token.AccessToken);\r\n\r\n var response = await httpClient.PostAsync($"\/admin\/realms\/{realm}\/users", userRequest);\r\n\r\n if (response.IsSuccessStatusCode)\r\n return Results.Ok(new { message = "Kullan\u0131c\u0131 ba\u015far\u0131yla olu\u015fturuldu ve \u00f6zel alanlar eklendi!" });\r\n\r\n var errorContent = await response.Content.ReadAsStringAsync();\r\n return Results.BadRequest(new { error = errorContent });\r\n});\r\n<\/pre>\n<\/div>\nKullan\u0131c\u0131 olu\u015fturulurken User profile<\/em>‘daki ekstradan tan\u0131mlanm\u0131\u015f olan attribute’lara de\u011fer g\u00f6nderebilmek i\u00e7in yukar\u0131daki gibi bir \u00e7al\u0131\u015fma yap\u0131lmas\u0131 gayet yeterlidir. Misal olarak bu endpoint’e a\u015fa\u011f\u0131daki body’de bir istekte bulunulursa ‘xyz’ kullan\u0131c\u0131s\u0131 olu\u015fturulurken belirtilen telefon numaras\u0131yla olu\u015fturulacakt\u0131r:<\/p>\n \n\r\n{\r\n "username": "xyz",\r\n "enabled": true,\r\n "email": "xyz@gmail.com",\r\n "emailVerified": true,\r\n "firstName": "Xyz",\r\n "lastName": "Zyx",\r\n "customAttributes": {\r\n "phone-number": [\r\n "0 (507) 751 45 92"\r\n ]\r\n }\r\n}\r\n<\/pre>\n<\/div>\n<\/span>Kullan\u0131c\u0131ya Ge\u00e7ici (Temporary) ve Kal\u0131c\u0131 (Permanent) \u015eifre Tan\u0131mlama<\/span><\/h5>\nKeycloak’da kullan\u0131c\u0131 \u015fifrelerini tan\u0131mlarken ge\u00e7ici (temporary) ve kal\u0131c\u0131 (permanent) ayr\u0131m\u0131, temel olarak g\u00fcvenlik ve kullan\u0131c\u0131 y\u00f6netimi politikalar\u0131n\u0131 desteklemek amac\u0131yla varl\u0131k g\u00f6stermektedir. Bu ayr\u0131m, kullan\u0131c\u0131lara admin<\/code> taraf\u0131ndan verilen ba\u015flang\u0131\u00e7 \u015fifrelerinin kal\u0131c\u0131 olarak kullanmas\u0131n\u0131 \u00f6nleyerek, daha g\u00fcvenli bir kimlik do\u011frulama s\u00fcreci sa\u011flamaktad\u0131r. Ge\u00e7ici \u015fifre, kullan\u0131c\u0131y\u0131 ilk giri\u015fte \u015fifre de\u011fi\u015ftirmeye zorlayarak, e-posta gibi g\u00fcvensiz kanallardan \u015fifre payla\u015f\u0131m\u0131 gibi potansiyel g\u00fcvenlik risklerine kar\u015f\u0131 korumaktad\u0131r. Kal\u0131c\u0131 \u015fifre ise, do\u011frudan uzun vadeli kullan\u0131m i\u00e7in ayarlanmakta ve zorunlu de\u011fi\u015fiklik gerektirmemektedir.<\/p>\n Keycloak’da ge\u00e7ici \u015fifre tan\u0131mlanm\u0131\u015f bir kullan\u0131c\u0131 ilk giri\u015f yapt\u0131\u011f\u0131nda Keycloak taraf\u0131ndan otomatik bir \u015fekilde \u015fifre g\u00fcncellemeye y\u00f6nlendirilecek ve yeni \u015fifre girilmedi\u011fi taktirde oturum a\u00e7\u0131m\u0131na izin verilmeyecektir.<\/p>\n Keycloak’da \u015fifre de\u011fi\u015fimini ger\u00e7ekle\u015ftirebilmek i\u00e7in a\u015fa\u011f\u0131daki endpoint’e PUT<\/em> iste\u011finde bulunmak gerekmektedir:<\/p>\n \n \ud83d\udd17 PUT \/admin\/realms\/{realm}\/users\/{userId}\/reset-password \n<\/strong>\n<\/div>\nBody:<\/p>\n \n\r\n{\r\n "type": "password",\r\n "value": string,\r\n "temporary": boolean\r\n}\r\n<\/pre>\n<\/div>\n\u0130stekte a\u015fa\u011f\u0131daki gibi ger\u00e7ekle\u015ftirilebilir:<\/p>\n \n\r\napp.MapPut("\/user\/{userId}\/reset-password\/{realm}", async (string userId, string realm, TokenRequestService tokenRequestService, IHttpClientFactory httpClientFactory, SetPasswordRequest request) =>\r\n{\r\n var token = await tokenRequestService.GetAccessTokenAsync();\r\n using var httpClient = httpClientFactory.CreateClient("keycloak");\r\n\r\n httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token.AccessToken);\r\n\r\n var passwordData = new\r\n {\r\n type = "password",\r\n value = request.Password,\r\n temporary = request.IsTemporary\r\n };\r\n\r\n var passwordJson = JsonSerializer.Serialize(passwordData);\r\n var passwordRequest = new StringContent(passwordJson, Encoding.UTF8, MediaTypeNames.Application.Json);\r\n\r\n var response = await httpClient.PutAsync($"\/admin\/realms\/{realm}\/users\/{userId}\/reset-password", passwordRequest);\r\n\r\n if (response.IsSuccessStatusCode)\r\n return Results.Ok(new { message = $"\u015eifre ba\u015far\u0131yla {(request.IsTemporary ? "ge\u00e7ici" : "kal\u0131c\u0131")} olarak ayarland\u0131!" });\r\n\r\n var errorContent = await response.Content.ReadAsStringAsync();\r\n return Results.BadRequest(new { error = errorContent });\r\n});\r\n<\/pre>\n<\/div>\n<\/span>Password Grant Type \u0130le Kullan\u0131c\u0131y\u0131 Do\u011frulama<\/span><\/h5>\nPassword Grant Type (Resource Owner Password Credentials Grant)<\/em>, OAuth 2.0’da en tart\u0131\u015fmal\u0131 ve en az tavsiye edilen ak\u0131\u015f t\u00fcr\u00fc olsa da maalesef hala \u00e7ok yayg\u0131n kullan\u0131lmakta oldu\u011fu i\u00e7in bilinmesi kritik arz eden bir davran\u0131\u015fa sahiptir.<\/p>\n Password Grant’da; client’\u0131n kullan\u0131c\u0131 bilgilerini (username & password) bildi\u011fi \/ ald\u0131\u011f\u0131 tek grant tipidir.<\/em><\/p><\/blockquote>\n Bu ak\u0131\u015f tipinde login i\u015flemini ger\u00e7ekle\u015ftirebilmek i\u00e7in \u00f6ncelikle a\u015fa\u011f\u0131daki endpoint’e verilen \u00f6rnek \u00e7al\u0131\u015fmadaki gibi bir i\u00e7erikle POST<\/em> iste\u011finde bulunulmas\u0131 gerekmektedir:<\/p>\n \n \ud83d\udd17 POST \/realms\/{realm}\/protocol\/openid-connect\/token \n<\/strong>\n<\/div>\n\n\r\napp.MapPost("\/user\/authenticate\/{realm}", async (string realm, IHttpClientFactory httpClientFactory, PasswordGrantRequest request) =>\r\n{\r\n using var httpClient = httpClientFactory.CreateClient("keycloak");\r\n\r\n var formData = new Dictionary<string, string>\r\n {\r\n ["grant_type"] = "password",\r\n ["client_id"] = request.ClientId,\r\n ["username"] = request.Username,\r\n ["password"] = request.Password\r\n };\r\n\r\n if (!string.IsNullOrEmpty(request.ClientSecret))\r\n formData["client_secret"] = request.ClientSecret;\r\n\r\n if (!string.IsNullOrEmpty(request.Scope))\r\n formData["scope"] = request.Scope;\r\n\r\n var formContent = new FormUrlEncodedContent(formData);\r\n\r\n var response = await httpClient.PostAsync($"\/realms\/{realm}\/protocol\/openid-connect\/token", formContent);\r\n\r\n if (response.IsSuccessStatusCode)\r\n {\r\n var tokenContent = await response.Content.ReadAsStringAsync();\r\n var tokenResponse = JsonSerializer.Deserialize<JsonElement>(tokenContent);\r\n\r\n return Results.Ok(new\r\n {\r\n accessToken = tokenResponse.GetProperty("access_token").GetString(),\r\n refreshToken = tokenResponse.TryGetProperty("refresh_token", out var rt) ? rt.GetString() : null,\r\n expiresIn = tokenResponse.GetProperty("expires_in").GetInt32(),\r\n tokenType = tokenResponse.GetProperty("token_type").GetString()\r\n });\r\n }\r\n\r\n var errorContent = await response.Content.ReadAsStringAsync();\r\n return Results.Unauthorized();\r\n});\r\n<\/pre>\n<\/div>\nBu ak\u0131\u015fta dikkat edilmesi gereken iki husus mevcuttur, biri; hangi client \u00fczerinden kullan\u0131c\u0131 ad\u0131 ve \u015fifreyle bir token talebinde bulunulacaksa, o client’\u0131n Direct access grants<\/em> authentication flow’u desteklemesi gereklili\u011fidir. Di\u011feri ise ilgili kullan\u0131c\u0131n\u0131n \u015fifresinin ge\u00e7ici olmamas\u0131 durumudur! Aksi taktirde token talebi ba\u015far\u0131l\u0131 olmayacakt\u0131r.<\/p>\n Ayr\u0131ca kodu incelerseniz client_secret<\/code> de\u011ferinin opsiyonel oldu\u011funu g\u00f6receksiniz. Bu client’\u0131n access type’\u0131na g\u00f6re de\u011fi\u015fiklik g\u00f6sterebilece\u011fi i\u00e7in opsiyonel yap\u0131lm\u0131\u015f bir de\u011ferdir. E\u011fer ki client; SPA’ler ya da mobile application’lar gibi public client ise bu t\u00fcr uygulamalarda client secret g\u00fcvenli bir \u015fekilde saklanamayaca\u011f\u0131 i\u00e7in haliyle secret de\u011feri olmaks\u0131z\u0131n bir \u00e7al\u0131\u015fma s\u00f6z konusu olacakt\u0131r. Yok e\u011fer backend API’ler yahut server-side web application’lar gibi confidential client<\/a> ise bu tarz uygulamalar\u0131n g\u00fcvenli sunucu ortam\u0131nda \u00e7al\u0131\u015fmas\u0131ndan kaynakl\u0131 secret de\u011feri g\u00fcvenle saklanabilece\u011finden, secret de\u011feriyle \u00e7al\u0131\u015fma ger\u00e7ekle\u015ftirilecektir.<\/p>\n <\/span>Kullan\u0131c\u0131n\u0131n Aktif Oturum (Session) Bilgilerine Eri\u015fme<\/span><\/h5>\nBir kullan\u0131c\u0131n\u0131n aktif oturum bilgilerini elde edebilmek i\u00e7in a\u015fa\u011f\u0131daki endpoint’e GET<\/em> iste\u011finde bulunulmas\u0131 yeterlidir:<\/p>\n\n \ud83d\udd17 GET \/admin\/realms\/{realm}\/users\/{userId}\/sessions \n<\/strong>\n<\/div>\n\n\r\napp.MapGet("\/user\/{userId}\/sessions\/{realm}", async (string userId, string realm, TokenRequestService tokenRequestService, IHttpClientFactory httpClientFactory) =>\r\n{\r\n var token = await tokenRequestService.GetAccessTokenAsync();\r\n using var httpClient = httpClientFactory.CreateClient("keycloak");\r\n\r\n httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token.AccessToken);\r\n\r\n var response = await httpClient.GetAsync($"\/admin\/realms\/{realm}\/users\/{userId}\/sessions");\r\n\r\n if (response.IsSuccessStatusCode)\r\n {\r\n var sessionsContent = await response.Content.ReadAsStringAsync();\r\n var sessions = JsonSerializer.Deserialize<JsonElement>(sessionsContent);\r\n\r\n return Results.Ok(new\r\n {\r\n userId,\r\n activeSessions = sessions.EnumerateArray().Select(session => new\r\n {\r\n id = session.GetProperty("id").GetString(),\r\n username = session.TryGetProperty("username", out var un) ? un.GetString() : null,\r\n ipAddress = session.TryGetProperty("ipAddress", out var ip) ? ip.GetString() : null,\r\n start = session.TryGetProperty("start", out var st) ? DateTimeOffset.FromUnixTimeMilliseconds(st.GetInt64()).DateTime : (DateTime?)null,\r\n lastAccess = session.TryGetProperty("lastAccess", out var la) ? DateTimeOffset.FromUnixTimeMilliseconds(la.GetInt64()).DateTime : (DateTime?)null,\r\n clients = session.TryGetProperty("clients", out var cl) ? cl.EnumerateObject().ToDictionary(c => c.Name, c => c.Value.GetString()) : null\r\n }).ToList()\r\n });\r\n }\r\n\r\n if (response.StatusCode == System.Net.HttpStatusCode.NotFound)\r\n return Results.NotFound(new { error = "Kullan\u0131c\u0131 bulunamad\u0131!" });\r\n\r\n var errorContent = await response.Content.ReadAsStringAsync();\r\n return Results.BadRequest(new { error = errorContent });\r\n});\r\n<\/pre>\n<\/div>\n<\/span>Access Token’\u0131 \u00c7\u00f6z\u00fcmleyelim<\/span><\/h5>\n\u015eimdi ise Keycloak \u00fczerinden hangi grant type ile \u00fcretilmi\u015f olursa olsun, bir access token’\u0131 \u00e7\u00f6z\u00fcmleyerek i\u00e7eri\u011finde yer alan claim’leri birlikte inceleyelim. Tabi bunun i\u00e7in jwt.io<\/a>‘dan istifade edece\u011fimizi s\u00f6ylemeye gerek yok san\u0131r\u0131m \ud83d\ude42 \n<\/a>Burada claim’lere dikkat ederseniz e\u011fer baz\u0131 rollerin default olarak geldi\u011fini g\u00f6receksiniz.<\/p>\n Evet, bizler bu \u00f6rne\u011fimizde gncy<\/code> username’ine sahip olan kullan\u0131c\u0131ya herhangi bir rol tan\u0131mlamaks\u0131z\u0131n token talebinde bulunmu\u015ftuk. Ama bak\u0131yoruz ki, hem realm seviyesinde hem de client seviyesinde default olarak tan\u0131ml\u0131 gelen rolleri g\u00f6zlemlemekteyiz.<\/p>\n Peki bu yetkiler nereden gelmektedir?<\/strong> \nBu roller Keycloak’un tasar\u0131m\u0131 gere\u011fi otomatik olarak gelmektedir. \u015e\u00f6yle ki;<\/p>\n \noffline_access<\/code> ve uma_authorization<\/code> rolleri realm seviyesinden default olarak gelmektedir.<\/li>\nmanage-account<\/code>, view-profile<\/code> ve manage-account-links<\/code> rolleri ise client seviyesinden default olarak gelmektedir.<\/li>\n<\/ul>\nPeki neden bunlar default gelmektedir?<\/strong> \nBu yetkiler realm settings k\u0131sm\u0131nda varsay\u0131lan olarak ayarland\u0131\u011f\u0131 i\u00e7in…<\/a>Ee iyi de hoca, bu g\u00f6rselde default-roles-master<\/code> ve manage-account-links<\/code> yetkileri yok!<\/em> dedi\u011finizi duyar gibiyim… Evet, bunlardan manage-account-links<\/code> yetkisi manage-account<\/code>‘la birle\u015ftirilmi\u015f oldu\u011fu i\u00e7in, dolay\u0131s\u0131yla manage-account<\/code> eklendi\u011finde otomatik token’a eklenmekte, default-roles-master<\/code> ise kullan\u0131c\u0131ya default olarak eklenen tek rol oldu\u011fu i\u00e7in o da haliyle token’da g\u00f6z\u00fckmektedir. Bunlar\u0131n g\u00f6rsellerini payla\u015fmasam da sizler gidip kendiniz g\u00f6zlemleyebilirsiniz \ud83d\ude42<\/p>\n <\/span>UserInfo Endpoint ile Kullan\u0131c\u0131 Bilgilerine Eri\u015fim<\/span><\/h5>\nUserInfo, access token \u00fczerinden kullan\u0131c\u0131ya ait bilgileri (claims) okumak i\u00e7in kullan\u0131lan standart bir OpenID Connect endpoint’idir. \u00d6zellikle password grant, authorization code ve refresh token ak\u0131\u015flar\u0131nda elde edilen token’lardan sonra s\u0131k\u00e7a kullan\u0131lmaktad\u0131r. <\/p>\n<\/a>UserInfo endpoint’i ile ilgili token’\u0131n kime ait oldu\u011fu bilgisini rahatl\u0131kla edinebilmekteyiz. \u015e\u00f6yle ki; bir \u00f6nceki ba\u015fl\u0131kta access token’\u0131 \u00e7\u00f6z\u00fcmlemi\u015f ve claim’lerini incelemi\u015ftik. Hatta dikkat ettiyseniz, \u00e7\u00f6z\u00fcmlenmi\u015f token g\u00f6rselinde bu token’\u0131n kime ait oldu\u011funa dair \u00f6zel bilgilerin oldu\u011fu yandaki b\u00f6l\u00fcm mevcuttur. \u0130\u015fte bizler, eldeki token’da bulunan bu kullan\u0131c\u0131 bilgilerine, token’\u0131 decode etmeye gerek kalmaks\u0131z\u0131n UserInfo endpoint’inden istifade ederek h\u0131zl\u0131ca eri\u015febilmekteyiz.<\/p>\n \n \ud83d\udd17 GET \/realms\/{realm}\/protocol\/openid-connect\/userinfo \n<\/strong>\n<\/div>\n\n\r\napp.MapGet("\/user\/userinfo\/{realm}", async (string realm, IHttpClientFactory httpClientFactory, [Microsoft.AspNetCore.Mvc.FromHeader(Name = "Authorization")] string? authorization) =>\r\n{\r\n using var httpClient = httpClientFactory.CreateClient("keycloak");\r\n\r\n if (string.IsNullOrEmpty(authorization) || !authorization.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))\r\n return Results.Unauthorized();\r\n\r\n var accessToken = authorization.Substring("Bearer ".Length).Trim();\r\n\r\n httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);\r\n\r\n var response = await httpClient.GetAsync($"\/realms\/{realm}\/protocol\/openid-connect\/userinfo");\r\n\r\n if (response.IsSuccessStatusCode)\r\n {\r\n var userInfoContent = await response.Content.ReadAsStringAsync();\r\n var userInfo = JsonSerializer.Deserialize<JsonElement>(userInfoContent);\r\n\r\n return Results.Ok(userInfo);\r\n }\r\n\r\n if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized)\r\n return Results.Unauthorized();\r\n\r\n var errorContent = await response.Content.ReadAsStringAsync();\r\n return Results.BadRequest(new { error = errorContent });\r\n});\r\n<\/pre>\n<\/div>\n<\/a>UserInfo neticesi…<\/p><\/div>Misal olarak yukar\u0131daki \u00f6rnek \u00e7al\u0131\u015fmaya g\u00f6z atarsan\u0131z e\u011fer request’in Authorization<\/em> header key’inden token de\u011feri al\u0131nmakta ve ilgili endpoint’e GET<\/em> iste\u011fi e\u015fli\u011finde g\u00f6nderilmektedir. Tabi bu iste\u011fin ba\u015far\u0131yla d\u00f6n\u00fc\u015f yapabilmesi i\u00e7in ilgili token talep edilirken openid<\/code> scope’u e\u015fli\u011finde edilmesi zaruridir. Aksi taktirde 403 status code’u e\u015fli\u011finde yetkisiz bir i\u015flem yap\u0131ld\u0131\u011f\u0131na dair neticeyle kar\u015f\u0131la\u015f\u0131l\u0131yor olunacakt\u0131r.<\/p>\n Bu endpoint, \u00f6zellikle frontend taraf\u0131nda kullan\u0131c\u0131 profil bilgilerine ihtiya\u00e7 oldu\u011funda olduk\u00e7a kullan\u0131\u015fl\u0131 olmaktad\u0131r. Ayr\u0131ca API Gateway’in de yer yer kullan\u0131c\u0131 bilgisi istemesinde de bu endpoint’ten istifade edilmektedir.<\/p>\n Nihai olarak; \nG\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere Keycloak, yaln\u0131zca bir kimlik do\u011frulama arac\u0131 de\u011fil, do\u011fru kullan\u0131ld\u0131\u011f\u0131nda son derece esnek ve g\u00fc\u00e7l\u00fc bir kullan\u0131c\u0131 y\u00f6netim platformu sunan bir teknolojidir. Bu yaz\u0131da, Keycloak \u00fczerinde \u00e7o\u011fu zaman y\u00fczeysel ge\u00e7ilen ancak ger\u00e7ek hayatta s\u0131k\u00e7a ihtiya\u00e7 duyulan kullan\u0131c\u0131 y\u00f6netimi senaryolar\u0131n\u0131 derinlemesine ele alm\u0131\u015f ve kullan\u0131c\u0131 attribute’lar\u0131n\u0131n hem aray\u00fcz hem de Administration REST API \u00fczerinden nas\u0131l y\u00f6netilece\u011fini, ge\u00e7ici ve kal\u0131c\u0131 \u015fifre tan\u0131mlama s\u00fcre\u00e7lerini, Password Grant Type ile kullan\u0131c\u0131 do\u011frulaman\u0131n kritik noktalar\u0131n\u0131 ve aktif oturum bilgilerinin nas\u0131l elde edilebilece\u011fini ad\u0131m ad\u0131m incelemi\u015f bulunuyor ve b\u00f6ylece kurumsal \u00f6l\u00e7ekte g\u00fcvenli ve s\u00fcrd\u00fcr\u00fclebilir bir kimlik altyap\u0131s\u0131 kurman\u0131n temel ta\u015flar\u0131n\u0131 pratik dokunu\u015flarla tecr\u00fcbe etmi\u015f oluyoruz.<\/p>\n Ayr\u0131ca \u00fcretilen token’lar\u0131n i\u00e7eri\u011fini \u00e7\u00f6z\u00fcmleyerek hangi rollerin ve claim’lerin neden varsay\u0131lan olarak geldi\u011fini netle\u015ftirmi\u015f, UserInfo endpoint’i \u00fczerinden kullan\u0131c\u0131 bilgilerine nas\u0131l eri\u015filebilece\u011fini de uygulamal\u0131 olarak g\u00f6stermi\u015f bulunuyoruz.<\/p>\n Bir sonraki i\u00e7eri\u011fimizde bu yap\u0131lar\u0131n authorization, role ve scope tasar\u0131m\u0131n\u0131 ve daha ileri g\u00fcvenlik senaryolarda nas\u0131l konumland\u0131r\u0131labileceklerini ele al\u0131yor olaca\u011f\u0131z.<\/p>\n \u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\nNot : \u00d6rnek \u00e7al\u0131\u015fmaya a\u015fa\u011f\u0131daki GitHub adresiden eri\u015febilirsiniz. \nhttps:\/\/github.com\/gncyyldz\/Keycloak.Examples<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Merhaba, Bu i\u00e7eri\u011fimizde; Keycloak platformunda kullan\u0131c\u0131 y\u00f6netimiyle ilgili s\u0131k kar\u015f\u0131la\u015f\u0131lan ancak genellikle y\u00fczeysel ge\u00e7ilen baz\u0131 ek senaryolara odaklan\u0131yor olaca\u011f\u0131z. Bu senaryolar; Keycloak’\u0131n varsay\u0131lan olarak sundu\u011fu kullan\u0131c\u0131 bilgilerine nas\u0131l ek alanlar eklenebilece\u011fi, kullan\u0131c\u0131lara ge\u00e7ici veya...<\/p>\n","protected":false},"author":1,"featured_media":28235,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5206,5554],"tags":[313,5612,5555,5603,5604,5609,5607,5608,5611,5610,5606,5605,5613,3894],"class_list":["post-28334","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-net","category-keycloak","tag-attribute","tag-direct-access-grants","tag-keycloak","tag-keycloak-attribute","tag-keycloak-user","tag-password-grant-type","tag-permanent","tag-permanent-password","tag-resource-owner-grant","tag-resource-owner-password-credentials-grant","tag-temporary","tag-temporary-password","tag-userinfo","tag-userinfo-endpoint"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=28334"}],"version-history":[{"count":16,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28334\/revisions"}],"predecessor-version":[{"id":28362,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28334\/revisions\/28362"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/28235"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=28334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=28334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=28334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}