Can we integrate keycloak to add security to a asp.net web application?

Question

As part of a project we have integrated keycloak with our .net core application, but we have a legacy system which is a asp.net web application, It have its own login screen whenever a user logs in it should fetch the username and password and validate against Keycloak.

The approach we are trying to do is.

• 1.Fetch all users from Keycloak on a specific realm

• 2.Parse the json and find whether the specifc username and password exist in that json array.

Is this way of giving authentication is correct?

Need some suggestion!!!

Answer 1

Take a look at their basic authentication example...

https://github.com/keycloak/keycloak/tree/master/examples/basic-auth

As stated in the comments. Returning JSON with all of the username and passwords is NOT secure, hashed/salted/or not, it doesn't matter.