<div dir="ltr">That's a very long list of questions. Have you read through our documentation? I would hope it at least answers some of these questions. If not then breaking this list into smaller emails would make it easier to answer. Answering all these questions in one go is a fairly time consuming job.</div><div class="gmail_extra"><br><div class="gmail_quote">On 16 March 2016 at 22:35, John Dennis <span dir="ltr"><<a href="mailto:jdennis@redhat.com" target="_blank">jdennis@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I would appreciate having the following Keycloak concepts<br>
explained. Many thanks in advance!<br>
<br>
* What are the predefined clients?<br>
<br>
- When, why and where are you supposed to use these predefined<br>
clients?<br>
<br>
* What is the difference between realm roles and client roles?<br>
<br>
- Why are realm roles and client roles distinct?<br>
<br>
- How do they get assigned and for what purpose?<br>
<br>
- Why aren't roles always visible in the Web UI? For instance<br>
the available roles drop down box is often unpopulated even<br>
though they seem to be predefined in the source code. Why<br>
aren't they available for assignment in the Web UI?<br>
<br>
* How does role mapping work?<br>
<br>
- What is being mapped from and being mapped to?<br>
<br>
- What is the intended usage for these mappings?<br>
<br>
* What does it mean to create a role in the Web UI? What is it<br>
bound to?<br>
<br>
- How do roles created in the Web UI relate to the predefined<br>
roles?<br>
<br>
- Why does the Web UI allow me to create a new role with the<br>
same name as a predefined role? Are they the same role or is<br>
there a collision?<br>
<br>
* What are effective roles?<br>
<br>
- How are effective roles computed?<br>
<br>
- In the Web UI I see lists for "Available Roles", "Assigned<br>
Roles" and "Effective Roles". Sometimes I see a role in the<br>
"Effective Roles" list which is not in the "Assigned Roles"<br>
list. How and why does this happen?<br>
<br>
* What are composite roles?<br>
<br>
- How and where are they defined?<br>
<br>
- How are composite roles meant to be used?<br>
<br>
- When looking at a list of roles in the Web UI how does one<br>
identify a single role from a composite role?<br>
<br>
* What is the relationship between a Keycloak role and an OAuth2<br>
scope?<br>
<br>
* Are roles related to users in any fashion or is a role bound<br>
exclusively to a client (appearing only in the client's token).<br>
<br>
- How do you authenticate as a user and acquire specific roles?<br>
<br>
- Is it because a user grants a role via an OAuth scope which<br>
is then conveyed in the client token?)<br>
<br>
- If so how is it determined what roles a user is permitted to<br>
grant?<br>
<br>
- For example how is an admin user created? How are the fine<br>
grained admin roles bound to a user and how are these roles<br>
then conveyed in the token after an admin user authenticates?<br>
(see next question)<br>
<br>
* The ClientRegistrationAuth.requireCreate() method requires the<br>
bearer token from the realm administrator to have the<br>
AdminRoles.MANAGE_CLIENTS or AdminRoles.CREATE_CLIENT roles in<br>
the token, specifically in the resource_access part of the<br>
token, but no matter what I do to add roles in the Web UI to a<br>
realm admin the token roles remain unpopulated. How do these<br>
roles get assigned and propagated in the token?<br>
<br>
* How does a client differ from an application?<br>
<br>
- They seem to be closely related. How, why and when do you use<br>
one vs. the other?<br>
<br>
- The name "application" suggests they are external<br>
applications which might be secured by Keycloak but that<br>
doesn't seem to be the case, rather applications seem to be<br>
internal Keycloak entities. Are applications called<br>
applications because they are implemented as as servlets in<br>
Keycloak?<br>
<br>
- If so, is the reason applications are servlets is so their<br>
endpoints can have their own authn and authz?<br>
<br>
* What are adapters?<br>
<br>
* What is a service account?<br>
<br>
- How is a service account supposed to be used and for what<br>
purpose?<br>
<br>
- How is a service account created?<br>
<br>
- How is a service account authenticated?<br>
<br>
* How does OAuth2 client authentication work in Keycloak?<br>
<br>
- Are public clients authenticated? The OAuth2 spec talks a lot<br>
about the server authenticating the client but if the client<br>
is a public client it's not clear to me how this is done. How<br>
are public clients authenticated?<br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
--<br>
John<br>
_______________________________________________<br>
keycloak-dev mailing list<br>
<a href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
</font></span></blockquote></div><br></div>