<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">+1 to have support for scenario like
this. <br>
<br>
One small disadvantage of your approach is, that service2 will use
accessToken, which was issued to service1. It seems that more
proper way might be to have service on Keycloak side, that will
allow service2 to exchange the service1 token for it's own token.
However that will likely require much more work though...<br>
<br>
Marek<br>
<br>
On 08/08/16 09:58, Thomas Darimont wrote:<br>
</div>
<blockquote
cite="mid:CAK-7U1jy47W-y2qnh98cQ+pGLicwWDO4tkZbRy35TOBydbW7Tw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Hello group,<br>
</div>
<div><br>
</div>
<div>I have the following scenario:</div>
<div>1) A SSO authenticated User1 calls Service1 (confidential
client).</div>
<div>2) Service1 extracts access token.</div>
<div>3) Service1 performs a remote call to Service2 passing the
access token along.</div>
<div>4) Service2 needs to do something in the name of User1 in
Keycloak (e.g. set a user attribute, or create a new users)</div>
<div>5) Service2 uses org.keycloak.admin.client.Keycloak to
communicate with Keycloak<br>
</div>
<div>to perform the requested operation.</div>
<div><br>
</div>
<div>I want to be able to propagate the access token in </div>
<div>Service to service calls and use the
'org.keycloak.admin.client.Keycloak' client</div>
<div>with the provided access token to perform an operation in
Keycloak. </div>
<div><br>
</div>
<div>Currently 'org.keycloak.admin.client.Keycloak' only
supports client credentials and / or password,</div>
<div>which it uses to get an refresh token to renew a
potentially timed out access token.</div>
<div><br>
</div>
<div>As a PoC I slightly adjusted the Keycloak client to allow
for externally provided access tokens:</div>
<div><a moz-do-not-send="true"
href="https://gist.github.com/thomasdarimont/d82c4478df997556a9d16afb79787459">https://gist.github.com/thomasdarimont/d82c4478df997556a9d16afb79787459</a><br>
</div>
<div><br>
</div>
<div>I think the Keycloak Client should also support "call once"
scenarios with a provided access token out of the box.</div>
<div><br>
</div>
<div>Shall I create a JIRA for this?</div>
<div><br>
</div>
<div>Cheers,</div>
<div>Thomas </div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-dev">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br>
</body>
</html>