Reputation: 31
Using a Vue SPA with Keycloak as IAM to connect API of various microservices. The user can be login to Keycloak with Authorization PKCE Code Grant Flow with a public client (no client-secret on the browser). It is used the official JavaScript Keycloak adapter. Each microservice is defined onto Keycloak with a reserved client, with permission and policies to read/write/delete resources. I can use Keycloak authorizations using only Confidential client. And that's correct to avoid to "publish" the client secret on the user browser's.
But how can use the server authorization API which requiring a confidential client when I logged in with a public client?
Upvotes: 1
Views: 336