title: Azure api management jwt-validate nested claims (roles from Keycloak)
body: <p>I'm trying to configure azure api management to validate a JWT. Furthermore I would also like to validate that the token contains particular roles as added by Keycloak.</p>
  <p>The keycloak issued JWTs look something like this:</p>
  <pre class="lang-json prettyprint-override"><code>{
    ...
    &quot;realm_access&quot;: {
      &quot;roles&quot;: [
        &quot;role-1&quot;,
        &quot;role-2&quot;
      ]
    },
    ...
  }
  </code></pre>
  <p>I'm trying to use a <a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#ValidateJWT" rel="nofollow noreferrer">jwt-validate policy</a>. My first hope was that I could simply define the policy like this:</p>
  <pre class="lang-xml prettyprint-override"><code>&lt;validate-jwt header-name=&quot;Authorization&quot; failed-validation-httpcode=&quot;401&quot; require-scheme=&quot;Bearer&quot;&gt;
     &lt;required-claims&gt;
        &lt;claim name=&quot;realm_access.roles&quot; match=&quot;all&quot;&gt;
           &lt;value&gt;role-1&lt;/value&gt;
        &lt;/claim&gt;
     &lt;/required-claims&gt;
  &lt;/validate-jwt&gt;
  </code></pre>
  <p>I didn't expect this to work and it didn't.</p>
  <p>My next approach was to try and use policy-expressions as illustrated <a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#authorize-access-to-operations-based-on-token-claims" rel="nofollow noreferrer">here</a> and <a href="https://github.com/Azure/api-management-policy-snippets/blob/4bfa5fe1dd4c97e4f477df9ad3ce315ce34f8989/examples/Parse%20a%20JWT%20token%20using%20expressions.xml#L16-L43" rel="nofollow noreferrer">here</a>:</p>
  <pre class="lang-xml prettyprint-override"><code>&lt;inbound&gt;
     &lt;validate-jwt header-name=&quot;Authorization&quot; failed-validation-httpcode=&quot;401&quot; require-scheme=&quot;Bearer&quot;&gt;
     &lt;/validate-jwt&gt;
     &lt;choose&gt;
        &lt;when condition=&quot;@{
            var jwt = (Jwt)context.Variables[&quot;valid-jwt&quot;];
            var roles = jwt.Claims[&quot;realm_access&quot;][&quot;roles&quot;];
            return !Array.Exists(permissions, element =&gt; element == &quot;role-1&quot;);
        }&quot;&gt;
           &lt;return-response&gt;
              &lt;set-status code=&quot;403&quot; reason=&quot;Forbidden&quot; /&gt;
           &lt;/return-response&gt;
        &lt;/when&gt;
     &lt;/choose&gt;
  &lt;/inbound&gt;
  </code></pre>
  <p>This seems to be invalid C# and when trying to submit azure complains about types.</p>
  <p>To be honest, I've never done any C# and it seems to me that some sort of casting here could do the trick. But then again I'm not sure, as it also seems from the <a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-policy-expressions#ContextVariables" rel="nofollow noreferrer">documentation</a> that the data structure it creates from the JWT doesn't support nested claims.</p>
  <p>I currently feel very stuck here and would very much appreciate any help. Thank you.</p>
  <p><strong>Edit 29.12.2021:</strong></p>
  <p>Thanks to a comment I've looked at the following stackoverflow questions and haven't found any applicable solutions:</p>
  <ul>
  <li><a href="https://stackoverflow.com/questions/67106906/azure-apim-validate-jwt-based-on-two-different-claims">Azure APIM Validate JWT based on two different claims</a></li>
  <li><a href="https://stackoverflow.com/questions/44539958/azure-api-management-validate-jwt-token-scope">Azure API Management : validate jwt token scope</a></li>
  <li><a href="https://stackoverflow.com/questions/65440505/jwt-validation-failed-jwt-not-present-in-azure-api-management-service">&quot;JWT Validation Failed: JWT not present..&quot; in Azure API Management Service</a></li>
  </ul>