Repository navigation
Replies: 1 comment 2 replies
|
Hello, Direct Access Grants are still supported in Keycloak 26.6.3, so the behavior you are seeing is expected. Keycloak’s current documentation still describes the Resource Owner Password Credentials flow as Direct Access Grants and states that it is available when The important distinction is that issue [#25141](#25141) did not remove the password grant globally. OAuth 2.1 support was implemented through Client Policies and client profiles. Those profiles include the I could not find a public Keycloak announcement or milestone specifying a release in which Direct Access Grants will be removed completely. Therefore, I would not base the migration plan on a future removal date. I would treat the flow as legacy and migrate proactively. A typical migration path would be:
OAuth 2.1 is currently still an active Internet-Draft rather than a final RFC, although the current draft omits the password grant: [IETF OAuth 2.1 draft](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1). Independently, the OAuth 2.0 Security Best Current Practice document states that the Resource Owner Password Credentials Grant MUST NOT be used: [RFC 9700](https://datatracker.ietf.org/doc/html/rfc9700). In the meantime, you can apply the appropriate built-in OAuth 2.1 Client Policy profile to migrated clients and disable Direct Access Grants for clients that have already moved to another flow. |
|
Adding to what @lubineitor said, you can also disable it for all clients if you want nobody to use Direct Access Grant. |
|
Hello, First of all, thank you for the detailed responses. For my use case, the client credentials flow could work, but Keycloak's choice not to allow storing hashed client secrets is an issue. I fully understand the alternatives (Vault, mTLS, and signed JWT), but it is unnecessary complexity just to compensate for a storage choice that doesn't follow best practices. I also understand there are discussion around it since 2021 and a willing to propose the feature but it seems it will not be any time soon #8455 . |
Uh oh!
There was an error while loading. 8000 Please reload this page.
Hello,
From my understanding, the Password grant type (Direct Access Grants in Keycloak) is deprecated. The new OAuth 2.1 specification seems to completely remove support for this flow.
I noticed that there is an issue (#25141) aimed at implementing OAuth 2.1 recommendations in Keycloak, which has been marked as completed since March 1, 2024. However, this ticket contains the following line:
"Not Allow Resource Owner Password Credentials Grant: Keycloak does not allow a client to request a resource owner password credentials grant."
My version of Keycloak (26.6.3) still allows enabling Direct Access Grants.
Is there a target Keycloak version planned that will completely remove support for this flow ?
It is for prioritize a migration.
Thanks in advance for your help.
All reactions