<div dir="ltr"><div><div><div>Hi Marek,<br><br></div><div>Thank you for your answer. I understand that I should use an adapter, but it is unclear to me how that will work in my situation.<br><br></div>I will try to clarify.<br>I am using JBoss Apiman which uses JBoss Keycloak to manage its realm. Both JBoss Apiman and JBoss Keycloak run on the same Wildfly application server. Apiman runs on wildfly so my assumption is that an adapter is already used to secure the Apiman GUI and to do the back channelling.<br><br></div><div>But next to the Apiman GUI there is a Apiman gateway which uses a Keycloak OAuth plugin to enforce a security policy on managed api calls. The gateway itself is not secured by OAuth and is not known as a client in a keycloak realm. But the Keycloak OAuth plugin does expect a bearer token.<br><br></div><div>I am unsure where I could apply an adapter to acomplish this and which adapter it should be.<br></div><div><br>My setup is similair to the one discussed here: <a href="http://www.apiman.io/blog/gateway/security/oauth2/keycloak/authentication/authorization/2015/06/09/keycloak-oauth2.html">http://www.apiman.io/blog/gateway/security/oauth2/keycloak/authentication/authorization/2015/06/09/keycloak-oauth2.html</a> with the difference that I use a third party login. So I cannot use direct access grants.<br><br></div>Regards,<br><br></div>Ton<br><div><div><br><div><div><div></div></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-12-08 17:15 GMT+01:00 Marek Posolda <span dir="ltr"><<a href="mailto:mposolda@redhat.com" target="_blank">mposolda@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<div>After finish of OIDC authentication,
Keycloak will redirect to your application with the "code"
parameter. Keycloak will always do this, it doesn't matter if you
authenticated through SAML identity broker or username/password
form or any other method. Then you theoretically need to exchange
the code for access-token in backchannel request, however as long
as you use our adapters, you don't need to care about it as
adapter will do it for you.<br>
<br>
We have examples (using adapters) where you can also see how is
bearer access token retrieved and then used for additional REST
calls to REST endpoints secured by bearer token. See the demo
example and the "customer-portal" and "product-portal"
applications.<br>
<br>
Marek<br>
<br>
On 08/12/15 16:48, Ton Swieb wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>Hi,<br>
<br>
</div>
How can I obtain a bearer token from keycloak without
using the direct access grant (<a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/direct-access-grants.html" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/direct-access-grants.html</a>).<br>
<br>
</div>
<div>I have configured a SAML Identity Broker in Keycloak
which handles the login for my realm. As a result I do not
have a username/password combination to POST it to:<br>
<br>
<code>/{keycloak-root}/realms/{realm-name}/protocol/openid-connect/toke</code>n<br>
</div>
<div><br>
</div>
<div>How would I obtain a bearer token in this situation?<br>
<br>
</div>
</div>
Kind regards,<br>
<br>
</div>
Ton<br>
</div>
<br>
<fieldset></fieldset>
<br>
<pre>_______________________________________________
keycloak-user mailing list
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</div>
</blockquote></div><br></div>