<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>I would use keycloak.js adapter with auth-code flow. I
personally don't like implicit flow for a number of reasons:</p>
<p>* access tokens get stored in browser history</p>
<p>* You have to perform the whole redirect dance when the access
token expires</p>
<p>As far as Tomcat goes, we have an adapter for various tomcat
versions. These tomcat instances would probably use bearer tokens
to be secured. So, the javascript app uses keycloak.js to obtain
the token. REST invocations to TOMCAT are secured by a bearer
token. Tomcat app has a keycloak adapter installed to be able to
verify access tokens.<br>
</p>
<br>
<div class="moz-cite-prefix">On 7/26/16 9:03 AM,
<a class="moz-txt-link-abbreviated" href="mailto:Mohan.Radhakrishnan@cognizant.com">Mohan.Radhakrishnan@cognizant.com</a> wrote:<br>
</div>
<blockquote
cite="mid:E1B160F4999FD6449524E16C2CB94E0307986D41@CTSINCHNSXMBE.cts.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"> I have the standalone keycloak
server issuing tokens. Client is going to be JavaScript. I
enabled ‘implicit’ and issued
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a class="moz-txt-link-freetext" href="http://localhost:8080/auth/realms/MyRealm/protocol/openid-connect/auth?response_type=id_token%20token&redirect_uri=http%3A%2F%2Flocalhost:8000%2F&realm=">http://localhost:8080/auth/realms/MyRealm/protocol/openid-connect/auth?response_type=id_token%20token&redirect_uri=http%3A%2F%2Flocalhost:8000%2F&realm=</a>
MyRealm &client_id= MyRealm &scope=user<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I get the id_token. I am used to getting
the ‘access token’ in other IDP’s. Are they the same in
Keycloak ?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">How do I verify the token inside my Tomcat
?<o:p></o:p></p>
<p class="MsoNormal">In other installations we run the IDP
separately. So I am doing the same with Keycloak.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Mohan<o:p></o:p></p>
</div>
This e-mail and any files transmitted with it are for the sole use
of the intended recipient(s) and may contain confidential and
privileged information. If you are not the intended recipient(s),
please reply to the sender and destroy all copies of the original
message. Any unauthorized review, use, disclosure, dissemination,
forwarding, printing or copying of this email, and/or any action
taken in reliance on the contents of this e-mail is strictly
prohibited and may be unlawful. Where permitted by applicable law,
this e-mail and other e-mail communications sent to and from
Cognizant e-mail addresses may be monitored.
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>