Repository navigation
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
{{ message }}
8000
Heading
Bold
Italic
Quote
Code
Link
Numbered list
Unordered list
Task list
Attach files
Mention
Reference
Menu
reacted with thumbs up emoji
reacted with thumbs down emoji
reacted with laugh emoji
reacted with hooray emoji
reacted with confused emoji
reacted with heart emoji
reacted with rocket emoji
reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
I'm developing a desktop application that needs to communicate with a backend service responsible for retrieving data from third-party systems. Once a user is authenticated and authorized for the backend service, the backend service should be able to exchange its access token for tokens that allow access to these third-party services. Since desktop app is considered public client, the client for the backend-service has to be configured as a public client in Keycloak. It will support the PKCE flow for additional security. This public client has to support token exchange in order to enable the backend to perform token exchange and call REST APIs of third-party systems.
To protect the public client from unauthorized access, I'll configure specific redirect_uris and issue short-lived access tokens. Additionally, the clients configured for third-party systems will be confidential clients.
Is there planned support for token exchange in public clients using the PKCE flow? If not, how can this scenario be securely implemented without official support?
All reactions