How to authenticate a confidential Keycloak client API consumer without consumer's password nor sharing client secret?

Asked Nov 20 '19 at 15:10

Active Nov 20 '19 at 23:06

Viewed 467 times

We have an application defined as a confidential client in Keycloak (it is a web application needing login authentication, but also its APIs consumers authentication). How can our client authenticate the API consumer without sharing our client secret with him, neither he shares his password with our client ?

Here a schema

Is 'keycloak confidential client' configuration for MyApp1 a good choice ? I can't assume that MyApp2 has to have MyApp1's secret to be able to connect with MyUser in MyApp1.Or that it has to send MyUser's password to MyApp1. Or MyApp1 has to become public keycloak client, in order to MyApp2 being able to connect MyUser in without secret.

Isn't there any other way, remaining confidential but no secret neither password sharing ?

Thank in advance for you help.

edited Nov 20 '19 at 23:06

asked Nov 20 '19 at 15:10

Magalo

Can you draw a simple diagram showing all relations (the client, web login, Keycloak)? It would make the description much clearer. – Yuri Nov 20 '19 at 19:50
Did it ! Thanks for you help .. – Magalo Nov 20 '19 at 23:07
@Magalo Can you share your answer to fellow developers ? – power-cut Oct 16 '21 at 15:35

How to authenticate a confidential Keycloak client API consumer without consumer's password nor sharing client secret?

0 Answers0