CODEWITHSUNDEEP
javaspringspring-securitykeycloakkeycloak-services
KFed
KFed

Reputation: 33

What does Keycloak Java Adapter property "public-client" mean?

According to Keycloak documentation, the Java Adapter has property named public-client described as

If set to true, the adapter will not send credentials for the client to Keycloak

What does this "will not send credentials to Keycloak" actually mean?

Upvotes: 3

Views: 1450

Answers (1)

dreamcrash
dreamcrash

Reputation: 51453

In Keycloak you can set a client to be public or confidential (or bearer-only):

enter image description here

From the OAuth 2.0 one can read:

OAuth defines two types of clients: confidential clients and public clients.

Confidential clients are applications that are able to securely authenticate with the authorization server, for example being able to keep their registered client secret safe.

Public clients are unable to use registered client secrets, such as applications running in a browser or on a mobile device.

And in more detail from source one can read:

According to the OAuth 2.0 spec, applications can be classified as either confidential or public. The main difference relates to whether or not the application is able to hold credentials (such as a client ID and secret) securely. This affects the type of authentication the applications can use.

Confidential applications can hold credentials in a secure way without exposing them to unauthorized parties.

If the client is confidential, then it will contain a client secret:

enter image description here

What does this "will not send credentials to Keycloak"

In means that in the requests that client secret will not be sent.

Upvotes: 5

Related Questions