<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:13px"><div id="yui_3_16_0_1_1439863722903_2784">Bill/Stian,</div><div id="yui_3_16_0_1_1439863722903_2982"><br></div><div id="yui_3_16_0_1_1439863722903_2785" dir="ltr">Is it possible to use an external system to authenticate a client for the client credentials grant option? In our organization, we have a large number of applications that interact with each other using kerberos accounts. Today, a client application 1 will use its kerberos id and keytab to authenticate against MIT kerberos and get a custom token which is passed to client application 2 which then validates that token and grants access to the first application. Now if we want to use Keycloak's client credentials grant, the client application 1 is expected to have its client_id and secret registered with keycloak. It is not possible for all our existing applications to discard the current Kerberos account and go with this new client_id and secret required by Keycloak. So we are wondering, if there is any way, we can avoid registering a client application with keycloak and use our existing Kerberos infrastructure to do the client authentication and then provide the access token based on the client credentials grant option. If that is not possible, any pointers on how we can use Keycloak without requiring all our thousands of apps to register with keycloak?</div><div id="yui_3_16_0_1_1439863722903_2785" dir="ltr"><br></div><div id="yui_3_16_0_1_1439863722903_2785" dir="ltr">Thanks in advance,</div><div id="yui_3_16_0_1_1439863722903_2785" dir="ltr">Raghu</div></div></body></html>