37 lines
2.4 KiB
XML
37 lines
2.4 KiB
XML
|
<section id="jaas-adapter">
|
||
|
|
<title>JAAS plugin</title>
|
||
|
|
<para>
|
||
|
|
It's generally not needed to use JAAS for most of the applications, especially if they are HTTP based, but directly choose one of our adapters.
|
||
|
|
However some applications and systems may still rely on pure legacy JAAS solution. Keycloak provides couple of login modules
|
||
|
|
to help with such use cases. Some login modules provided by Keycloak are:
|
||
|
|
</para>
|
||
|
|
<para>
|
||
|
|
<variablelist>
|
||
|
|
<varlistentry>
|
||
|
|
<term>org.keycloak.adapters.jaas.DirectAccessGrantsLoginModule</term>
|
||
|
|
<listitem>
|
||
|
|
<para>
|
||
|
|
This login module allows to authenticate with username/password from Keycloak database. It's using
|
||
|
|
<link linkend="direct-access-grants">Direct Access Grants</link> Keycloak endpoint to validate on Keycloak side if provided username/password is valid.
|
||
|
|
It's useful especially for non-web based systems, which need to rely on JAAS and want to use Keycloak credentials, but can't use classic browser based
|
||
|
|
authentication flow due to their non-web nature. Example of such application could be messaging application or SSH system.
|
||
|
|
</para>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
<varlistentry>
|
||
|
|
<term>org.keycloak.adapters.jaas.BearerTokenLoginModule</term>
|
||
|
|
<listitem>
|
||
|
|
<para>
|
||
|
|
This login module allows to authenticate with Keycloak access token passed to it through CallbackHandler as password.
|
||
|
|
It may be useful for example in case, when you have Keycloak access token from classic web based authentication flow
|
||
|
|
and your web application then needs to talk to external non-web based system, which rely on JAAS. For example to JMS/messaging system.
|
||
|
|
</para>
|
||
|
|
</listitem>
|
||
|
|
</varlistentry>
|
||
|
|
</variablelist>
|
||
|
|
</para>
|
||
|
|
<para>
|
||
|
|
Both login modules have single configuration property <literal>keycloak-config-file</literal> where you need to provide location of keycloak.json configuration file.
|
||
|
|
It could be either provided from filesystem or from classpath (in that case you may need value like <literal>classpath:/folder-on-classpath/keycloak.json</literal> ).
|
||
|
|
</para>
|
||
|
|
</section>
|