Repository navigation
Keycloak token for OIDC dynamic client registration integration with 3rd party platforms #15158
Unanswered
souravs17031999
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hi community,
I am integrating API management platform with Keycloak as client providers which uses OIDC dynamic client registration protocol for dynamically creating clients but I am facing one issue that the platform is sending open plain POST request i.e. using open registration flow instead of authenticated flows i.e. by using some kind of token to be authenticated against.
For security purposes, I need this to be restrictive and only allow client creation if it's authenticated requests.
Only way it can send authenticated requests is to manually fill in "Authorization" header which is currently empty.
I know there are different ways it could be acheived like
I tried dedicated service-accounts for that realm and assigning appropriate roles to that user and using that token but it has expiry and also not sure if it will persists between KC restarts. can it help if I increase the expiry of token to few years ?
Another way, I am trying currently is to use initial access tokens but that still has limited "count" and "expiry". I tried tweaking it somehow to have unlimited count and expiry but could not find it.
Is there a way KC provides some token (which should also persists between KC restarts and not expires) for these integrations similar to other OIDC providers which I searched (they have some api token for authenticating requests to the server) OR If the above approaches looks okay ?
All reactions