CODEWITHSUNDEEP
spring-bootkeycloak
sancho21
sancho21

Reputation: 3643

How to combine bearer-only and client_credentials in Keycloak?

I have a backend API server which was initially bearer-only mode which is accepting token from FE. Now, there's a need for the server to call another service in the same keycloak realm which grant type is usually client_credentials.

User -> FE server --(bearer only)--> BE server --(client credential)--> Other service

The question is, how to combine bearer-only and client credential in the BE server? Do I have to define 2 clients in the Keycloak realm for the same BE (one is bearer only, the other one is client credentials).

Upvotes: 0

Views: 1584

Answers (1)

Chris Savory
Chris Savory

Reputation: 2755

We have solved this with two separate clients in Keycloak

Client #1 (token is generated from SPA client and used for Bearer Auth)

  • Access Type: Public

Client #2 (for server to server)

  • Access Type: Confidential
  • Service Accounts: On
  • On the Service Account Roles Tab: define which roles that token will get

EDIT:

On the spring side, you just need to reference Client #2 when setting up your keycloak AdapterDeploymentContext in your security config class. That is because any token generated by Client #1 or Client #2 will be a SSO token and your spring backend will point back to the realm for token verification.

Upvotes: 2

Related Questions