<div dir="ltr">I think in practice it makes sense. The bearer-only should not be shown in clients list as it's just about roles. The admin console should have redirect-uris for the admin console, but not have direct grant enabled. Finally the admin cli should only have direct grant enabled. That way they can be configured independently. As they are separate things and this is how we recommend others to organize their clients then we should do the same.</div><div class="gmail_extra"><br><div class="gmail_quote">On 7 December 2015 at 16:36, Bill Burke <span dir="ltr"><<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Sorry, makes sense now after reading your exchange. In practice though, does it matter to have this split? Is it not better to consolidate into one client?<span class=""><br>
<br>
On 12/7/2015 3:48 AM, Marek Posolda wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
+1. That's what we have now and it's good pattern IMO.<br>
<br>
Marek<br>
<br>
On 07/12/15 09:38, Stian Thorgersen wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
Should we not have one client for the roles that represents the<br>
services (bearer-only), then have a separate clients for admin GUI and<br>
CLI?<br>
<br>
On 7 December 2015 at 09:34, Marek Posolda <<a href="mailto:mposolda@redhat.com" target="_blank">mposolda@redhat.com</a><br></span><span class="">
<mailto:<a href="mailto:mposolda@redhat.com" target="_blank">mposolda@redhat.com</a>>> wrote:<br>
<br>
On 03/12/15 20:06, Bill Burke wrote:<br>
> * We can remove the realm-management client in each realm and<br>
just merge<br>
> the roles into security-admin-console.<br>
Not sure about this one TBH. Also in 1.7 we introduced the "admin-cli"<br>
client, which is used for direct-grants and has scope to<br>
realm-management similarly like security-admin-console. The<br>
security-admin-console is used for UI of admin console (javascript<br>
client) when admin-cli is used for direct access to admin REST<br>
endpoints<br>
for example from admin-client.<br>
<br>
Marek<br>
_______________________________________________<br>
keycloak-dev mailing list<br></span>
<a href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a> <mailto:<a href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a>><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
<br>
<br>
</blockquote>
<br>
</blockquote><div class="HOEnZb"><div class="h5">
<br>
-- <br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" rel="noreferrer" target="_blank">http://bill.burkecentral.com</a><br>
</div></div></blockquote></div><br></div>