<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">It seems you’re trying to enforce that only client B can call client C. This isn’t really something considered by OpenID Connect Spec. Are you using the access token from client A to call client C (from B)? If so, the client adapter can’t help you here. If your intent is just to protect service C from being called directly, just secure it behind a firewall so that only client B may access it.<div class=""><br class=""></div><div class="">It’s also not very clear what you’re try to accomplish by “protecting” access to client C.</div><div class=""><br class=""><div class="">
<div class="">Scott Rossillo</div><div class="">Smartling | Senior Software Engineer</div><div class=""><a href="mailto:srossillo@smartling.com" class="">srossillo@smartling.com</a></div><div class=""><br class=""></div><div class=""><span style="color: rgb(169, 169, 169); font-family: gesta, Arial, Helvetica, sans-serif; font-size: 14px; line-height: 20px; widows: 1; background-color: rgb(255, 255, 255);" class=""></span><div id="watermark" style="box-sizing: border-box; color: rgb(169, 169, 169); font-family: gesta, Arial, Helvetica, sans-serif; font-size: 14px; line-height: 20px; widows: 1; background-color: rgb(255, 255, 255);" class=""><a href="http://www.sigstr.com/" style="box-sizing: border-box; color: rgb(0, 124, 194); text-decoration: none; background-color: transparent; outline: 0px !important;" class=""><img alt="Powered by Sigstr" border="0" src="https://app.sigstr.com/uc/55e5d41c6533390d03580000/watermark" style="box-sizing: border-box; border: 0px; vertical-align: top; max-width: 100%; height: auto; width: inherit; color: rgb(99, 99, 99); font-family: Helvetica; font-size: 11px;" class=""></a></div></div>
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Dec 16, 2015, at 10:30 AM, Dirk Franssen <<a href="mailto:dirk.franssen@gmail.com" class="">dirk.franssen@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div style="font-size:12.8px" class="">Hi,</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">as I didn't receive any feedback on this question yet, I will resend it (perhaps due to pending subscription)</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class=""><span style="font-size:small" class="">On Tue, Dec 8, 2015 at 12:09 PM, Dirk Franssen </span><span dir="ltr" style="font-size:small" class=""><<a href="mailto:dirk.franssen@gmail.com" target="_blank" class="">dirk.franssen@gmail.com</a>></span><span style="font-size:small" class=""> wrote:</span><br style="font-size:small" class=""><blockquote class="gmail_quote" style="font-size:small;margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr" class=""><div style="font-size:12.8px" class="">Hi,</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">how would one configure Keycloak to obtain following scenario's?</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">Scenario 1:</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">client A: public (angular app)</div><div style="font-size:12.8px" class="">client B: bearer-only (microservice)</div><div style="font-size:12.8px" class="">client C: bearer-only (microservice)</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">- microservice B is allowed to call microservice C, but an authenticated user in the js app A should be forbidden to call microservice C directly.</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">Scenario 2:</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class=""><div class="">client A: public (angular app)</div><div class="">client B: confidential (1 war with a REST service AND a JSF application, both using the same EJB business layer which is accessing microservice C)</div><div class="">client C: bearer-only (microservice)</div></div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">- a user authenticated in the angular app can use the REST service of app B and will see the results of microservice C, but the user may not call microservice C directly<br class=""></div><div style="font-size:12.8px" class="">- a user authenticated in the JSF application will see the results of microservice C when using the JSF application, but should not be able to use microservice C directly (if the user would reuse the same access_token)</div><div style="font-size:12.8px" class="">- should there be different roles for the REST part and the JSF part of app B (for accessing microservice C)?</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">Kind regards,</div><div style="font-size:12.8px" class="">Dirk</div></div></blockquote></div></div>
_______________________________________________<br class="">keycloak-user mailing list<br class=""><a href="mailto:keycloak-user@lists.jboss.org" class="">keycloak-user@lists.jboss.org</a><br class="">https://lists.jboss.org/mailman/listinfo/keycloak-user</div></blockquote></div><br class=""></div></body></html>