50 lines
2.3 KiB
Text
Executable file
50 lines
2.3 KiB
Text
Executable file
= Service Accounts
|
|
|
|
Keycloak allows you to obtain an access token dedicated to some Client Application (not to any user). See http://tools.ietf.org/html/rfc6749#section-4.4[Client Credentials Grant] from OAuth 2.0 spec.
|
|
|
|
To use it you must have registered a valid confidential Client and you need to check the switch `Service Accounts Enabled` in Keycloak admin console for this client.
|
|
In tab `Service Account Roles` you can configure the roles available to the service account retrieved on behalf of this client.
|
|
Don't forget that you need those roles to be available in Scopes of this client as well (unless you have `Full Scope Allowed` on). As in normal login, roles from access token are intersection of scopes and the service account roles.
|
|
|
|
The REST URL to invoke on is `/{keycloak-root}/realms/{realm-name}/protocol/openid-connect/token`.
|
|
Invoking on this URL is a POST request and requires you to post the client credentials.
|
|
By default, client credentials are represented by clientId and clientSecret of the client in `Authorization: Basic` header, but you can also authenticate client with signed JWT assertion or any other custom mechanism for client authentication.
|
|
See <<_client_authentication,Client Authentication>> section for more details.
|
|
You also need to use parameter `grant_type=client_credentials` as per OAuth2 specification.
|
|
|
|
For example the POST invocation to retrieve service account can look like this:
|
|
|
|
[source]
|
|
----
|
|
|
|
POST /auth/realms/demo/protocol/openid-connect/token
|
|
Authorization: Basic cHJvZHVjdC1zYS1jbGllbnQ6cGFzc3dvcmQ=
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
grant_type=client_credentials
|
|
----
|
|
The response would be this http://tools.ietf.org/html/rfc6749#section-4.4.3[standard JSON document] from the OAuth 2.0 specification.
|
|
|
|
[source]
|
|
----
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json;charset=UTF-8
|
|
Cache-Control: no-store
|
|
Pragma: no-cache
|
|
|
|
{
|
|
"access_token":"2YotnFZFEjr1zCsicMWpAA",
|
|
"token_type":"bearer",
|
|
"expires_in":60,
|
|
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
|
|
"refresh_expires_in":600,
|
|
"id_token":"tGzv3JOkF0XG5Qx2TlKWIA",
|
|
"not-before-policy":0,
|
|
"session_state":"234234-234234-234234"
|
|
}
|
|
----
|
|
|
|
The retrieved access token can be refreshed or logged out by out-of-bound request.
|
|
|
|
See the example application `service-account` from the main Keycloak `demo` example.
|