Claudio Barca
Claudio Barca

Reputation: 31

Keycloak - use authorized API resources with public client

Using a Vue SPA with Keycloak as IAM to connect API of various microservices. The user can be login to Keycloak with Authorization PKCE Code Grant Flow with a public client (no client-secret on the browser). It is used the official JavaScript Keycloak adapter. Each microservice is defined onto Keycloak with a reserved client, with permission and policies to read/write/delete resources. I can use Keycloak authorizations using only Confidential client. And that's correct to avoid to "publish" the client secret on the user browser's.

But how can use the server authorization API which requiring a confidential client when I logged in with a public client?

Upvotes: 1

Views: 336

Answers (0)

Related Questions