<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>Thank you very much for this; it's very helpful.</div>
<div> </div>
<div> </div>
<div>On Tue, Apr 12, 2016, at 05:45 PM, Thomas Darimont wrote:<br></div>
<blockquote type="cite"><div dir="ltr"><div>Hello,<br></div>
<div> </div>
<div>from my understanding and from reading the docs & mailing lists I'd explain the clients as follows:<br></div>
<div> </div>
<div>/account<br></div>
<div>web application with UI, currently embedded in keycloak itself, that serves as a self-service <br></div>
<div>account management application where users can change information about ther user account, <br></div>
<div>change passwords, have a look at their active sessions etc.<br></div>
<div> </div>
<div>You should leave this if you want your users to be able to manage their account themselves.<br></div>
<div> </div>
<div>/admin-cli<br></div>
<div>"technical" client (no UI) that was introduced in 1.7 and is used for direct-grants with <br></div>
<div>access-type "public" and has scope to realm-management (which implies some client roles like: <br></div>
<div>realm-admin, management-realm, manage-users, etc.) similarly like the security-admin-console. <br></div>
<div>This client can also be used for configuring the realm via the REST API or the Keycloak admin-client.<br></div>
<div> </div>
<div>You should leave this if you want to administer your realm via the REST API.<br></div>
<div> </div>
<div>/broker<br></div>
<div>"technical" client (no UI) is used for standard flow and has scope to read-token, allows the user <br></div>
<div>to access any stored external tokens (via the broker service).<br></div>
<div> </div>
<div>You should leave this if you want to do indentity brokering. (guessing here)<br></div>
<div> </div>
<div>/realm-management<br></div>
<div>"technical" client (no UI), similar to admin-cli but uses access-type bearer-only,<br></div>
<div>which means that instead of doing the oauth dance you need to pass<br></div>
<div>the access_token via the Authorization: Bearer TOKEN HTTP request header.<br></div>
<div> </div>
<div>You should leave this if you want to administer your realm via the REST API.<br></div>
<div> </div>
<div>/security-admin-console<br></div>
<div>web application with UI, currently embedded in keycloak itself, which serves as the management console <br></div>
<div>you are using to configure your realm via the browser.<br></div>
<div> </div>
<div>From keycloaks perspective the admin-console is also just an oauth client.<br></div>
<div> </div>
<div>You should leave this if you want to administer your realm via the admin console (which you probably do).<br></div>
<div>--<br></div>
<div> </div>
<div>Perhaps it would help to populate description field with a brief summary for the "default" client definitions.<br></div>
<div>Having those clients mentioned in the docs somewhere would be helpful as well.<br></div>
<div> </div>
<div>Cheers,<br></div>
<div>Thomas<br></div>
<div> </div>
<div><div> </div>
<div defang_data-gmailquote="yes"><div>2016-04-12 23:03 GMT+02:00 Aikeaguinea <span dir="ltr"><<a href="mailto:aikeaguinea@xsmail.com">aikeaguinea@xsmail.com</a>></span>:<br></div>
<blockquote style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204, 204, 204);border-left-style:solid;padding-left:1ex;" defang_data-gmailquote="yes"><div>When I create a new realm, I see that the following clients are<br></div>
<div> automatically created in that realm:<br></div>
<div> </div>
<div> account<br></div>
<div> admin-cl<br></div>
<div> broker<br></div>
<div> realm-management<br></div>
<div> security-admin-console<br></div>
<div> </div>
<div> It's hard for me to tell whether or not to delete these clients without<br></div>
<div> knowing what they're for, and I haven't successfully found documentation<br></div>
<div> on the subject. Might someone explain what these are about?<br></div>
<div> <span><span class="colour" style="color:rgb(136, 136, 136)"><br> --<br> <a href="http://www.fastmail.com">http://www.fastmail.com</a> - Accessible with your email software<br> or over the web<br> <br> _______________________________________________<br> keycloak-user mailing list<br> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></span></span></div>
</blockquote></div>
</div>
</div>
</blockquote><div> </div>
<div id="sig3995191"><div class="signature">--<br></div>
<div class="signature"> Aikeaguinea<br></div>
<div class="signature"> aikeaguinea@xsmail.com<br></div>
<div class="signature"> </div>
</div>
<pre>
--
http://www.fastmail.com - Same, same, but different...
</pre>
</body>
</html>