Repository navigation
Replies: 1 comment
|
@nirweb ,
Actually, you don't need to request a new token every time. A service account token (the one that you obtain via client credentials grant) has a lifetime of 5 minutes by default. It could be safely reused during that period. But it is also true that service account tokens cannot be refreshed, which is different from "normal" OAuth 2.0 access tokens. I would start with figuring out the proper token lifetime for your use case. If that doesn't solve the problem, I would suggest a gateway/integration service that would sit between your backend services and Keycloak. It could expose only a subset of admin APIs, use it's own client credentials to talk to Keycloak, and authenticate/identify the services using other methods like SPIFFE. This could reduce the load on Keycloak n-fold. |
Uh oh!
There was an error while loading. Please reload this page.
hello
I'm working on a system where multiple backend services need to perform actions like updating user data, creating new users, etc. These actions require authenticating with Keycloak using the client_credentials grant type to obtain an access token before making the actual API call.
Since the number of requests is very high, this means every single request starts by fetching an access token from Keycloak. This approach naturally raises the question of whether repeatedly obtaining a new access token for each request is a good practice.
Would it be more efficient and scalable to implement a centralized service that:
Checks if a previously obtained access token is still valid and reuses it if possible.
Only requests a new access token when the previous one has expired and then distributes it to all services that need it.
I’m concerned about:
Potential performance issues or overhead caused by frequent access token requests to Keycloak.
The best way to manage access tokens in a high-traffic environment to balance security, efficiency, and scalability.
What are the best practices in this scenario? Is there an inherent issue with repeatedly requesting access tokens using client_credentials, or is implementing a centralized token management service the recommended approach?
Any insights or recommendations would be greatly appreciated. Thank you!
All reactions