Is it possible to use the Keycloak for authentication only?

user_11717067 0
Viewed 160

I want to use JWT for authentication, so I am trying to use Keycloak to get the Bearer token. My problem is that when I set the scope=openid in the request. The response contains both the access_token and id_token as blow:

{
    "access_token": "eyJAlW7lLfxPta...MS85g",
    "expires_in": 300,
    "refresh_expires_in": 1800,
    "token_type": "Bearer",
    "id_token": "eyJhbGciOmQtMzJhOThS...Htm2OSGo9pVs-CWBJGaPC2Z2ib6FSSckzTxA",
    "not-before-policy": 0,
    "session_state": "d76a27af-3780-4843-9c6d-32a98c1f6625",
    "scope": "openid"
}

As I know the access_token is for authorization that I do not need it. I just need the id_token for authentication. Is it possible to remove the access_token from the Keycloak response, or it is just a global OIDC rule that id_token always comes with access_token? And Am I using the correct token or authentication must done by access_token?

jwt keycloak oauth-2.0 openid-connect
1 Answers

OpenID Connect (OIDC) is an authentication protocol built on top of OAuth 2.0.

  1. With OAuth 2.0, a user can authenticate with an authorization server and get you an access token.
  2. With OIDC, they can also give you a token called an ID token.

So I would say you can't omit access token when you are using OIDC protocol, because underlying OAuth 2.0 protocol generates it.

Source: https://developer.okta.com/docs/guides/validate-id-tokens/overview/

user_33486040
Related