Do Keycloak Clients have a Client Secret?

Question

Does keycloak client id has a client secret? I tried to create a client in keycloak admin but I was not able to spot client secret.

Is it auto generated? Where can I get the secret?

Answer 1

Your client need to have the access-type set to confidential , then you will have a new tab credentials where you will see the client secret.
https://wjw465150.gitbooks.io/keycloak-documentation/content/server_admin/topics/clients/oidc/confidential.html

Answer 2

Client need to have the access-type set to confidential and you can see the client Secret in credentials tab

Answer 3

Does keycloak client id has a client secret? I tried to create a client in keycloak admin but I was not able to spot client secret.

First, you should know that Keycloak implements OpenID Connect, which

is a simple identity layer on top of the OAuth 2.0 protocol.

According to the OAuth 2.0 protocol clients can be either confidential or public.

The main difference relates to whether or not the application is able to hold credentials (such as a client ID and secret) securely.

Regarding the confidential clients:

Because they use a trusted backend server, confidential applications can use grant types that require them to authenticate by specifying their client ID and client secret when calling the Token endpoint.

Armed with this knowledge you can easily create a client that will have a client secret as follows:

OLD Keycloak UI

1. Create a client with "Access Type" set to confidential:
2. Click the Save button;
3. Afterwards a new tab named "Credentials" will show up :
4. And there you can see the client secret:

NEW Keycloak UI

1. Go to your realm and the Clients
2. Click on the button Create client

3. Set the clientID, and the remains fields accordingly and click next
4. Set the option Client authentication to ON
5. Click on Save

To inspect the secret go to the clients > your client > tab credentials and click on the eye

In my personal Git repo you can find a script to extract the client secret. This script calls the endpoint

GET /{realm}/clients/{id}/client-secret

from the Keycloak admin API.

Answer 4

In keycloak version 20, access-type does not exist an as option. If your client to be configured does not already have authentication on, set it on and then click save.

Your client will then have a "Credentials Tab" on the top, next to "Settings", "Keys", "Roles" etc.

Click on the Credentials tab and your Client secret is found on that screen.

Answer 5

Yes, each keycloak client has a client secret. But for this, you have to change the access type. This differs from the keycloak version. In specific versions, you have to change the Access type from Public to Confidential In specific versions, you have to enable the Client authentication under the Capability config.

On saving this, you can see the credentials tab

You can copy the auto-generated client secret. You can also regenerate it any time

Answer 6

For me above mentioned step access-type tab not found. What did work for me is:

1. Select your realm in my case "istiomesh"
2. Select "clients" tab in left bar
3. You may see two tabs "client list" and "Initial access token". Select later one and create Initial access token

4. Copy that token and use as secret