8000 Resource Server to Resource Server REST API Call · keycloak keycloak · Discussion #14816 · GitHub
[go: up one dir, main page]
Skip to content
{"@context":"https://schema.org","@type":"QAPage","mainEntity":{"@type":"Question","name":"Resource Server to Resource Server REST API Call","text":"\u003cp dir=\"auto\"\u003eIn our microservices architecture there are 2 types of services / applications / clients that are registered to Keycloak:\u003cbr\u003e\n-public client, this is our frontend applications using vue js\u003cbr\u003e\n-bearer-only, this is our backend applications (resource servers) using java spring boot\u003cbr\u003e\nI have a usecase where I need my backend application A calling backend application B or vice versa to be accepted or respected but I do not want to use the access token from the public client to be pass to the other microservice because each resource server has their own unique set of roles that were used by their respective microservices to authorized each API endpoint.\u003cbr\u003e\nI just want to make sure that the REST API call is coming from the client that registered in keycloak which means this microservices is part of the services that I try to build.\u003cbr\u003e\nHere is a diagram about the use case I talk about\u003cbr\u003e\n\u003ca target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://user-images.githubusercontent.com/42630865/194826165-ffd4cb78-dd79-4d29-9a26-789e6a889699.jpg\"\u003e\u003cimg src=\"https://user-images.githubusercontent.com/42630865/194826165-ffd4cb78-dd79-4d29-9a26-789e6a889699.jpg\" alt=\"microservices\" style=\"max-width: 100%;\"\u003e\u003c/a\u003e\u003cbr\u003e\nIs there anything like client authentication, where I can authenticate using client id and secret and get an access token to be used to access any or restricted API endpoint of the specific client id?\u003c/p\u003e","upvoteCount":4,"answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"\u003cp dir=\"auto\"\u003eYou can use a confidential client with \"Service Accounts Enabled\". Such a client acts as a technical user with an own set of roles.\u003cbr\u003e\nSuch a client uses OAuth 2.0 Client credentials grant to get an access token.\u003c/p\u003e","upvoteCount":1,"url":"https://gitHub.com/keycloak/keycloak/discussions/14816#discussioncomment-3849001"}}}
Discussion options

Aleson95
Oct 10, 2022

You must be logged in to vote
Answered by jbman Oct 11, 2022

You can use a confidential client with "Service Accounts Enabled". Such a client acts as a technical user with an own set of roles.
Such a client uses OAuth 2.0 Client credentials grant to get an access token.

View full answer

Replies: 1 comment 1 reply

Comment options

jbman
Oct 11, 2022

You must be logged in to vote
1 reply
@Aleson95
Comment options

Aleson95 Oct 12, 2022
Author

Answer selected by Aleson95
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
2 participants
@Aleson95 @jbman
0