Client side authentication without redirection to Keycloak

user_1051462 0
Viewed 5138

Pretty simple question, spend a lot of time searching around.

Spring Boot 1.4.x application, with Spring Security, tried to use Keycloak for user management / authentication / authorisation, all works fantastic!

How do I avoid redirecting to Keycloak login form?

How do I implement my own authentication worlflow based on username-password input?

I see that I can ask for access-token and refresh-token, but should I implement all that token magic myself or there is some famous library people use?

Any github or examples would help. Thanks!

keycloak spring-boot spring-security
1 Answers

You might have a look into the Ressource Owner Password Credentials grant. It boils down to set the "Direct Access Grants Enabled " for your Keycloak client and implement the login logic yourself.

But please, PLEASE make sure to read this first: https://www.scottbrady91.com/OAuth/Why-the-Resource-Owner-Password-Credentials-Grant-Type-is-not-Authentication-nor-Suitable-for-Modern-Applications

You could also use some openid connect - libraries and get the data you need for the endpoints from the .well-known endpoint of your realm.

user_13415990
Related