Hi everyone,
I've been evaluating the "Direct Access Grants" functionality of Keycloak.
Overall, I think I can make it work for my use cases, but I do have a couple of concerns.
Chapter 12 of the documentation compares Keycloak's Direct Access Grants functionality
to OAuth2's "Resource Owner Password Credentials Grant." However, if I
understand the specification correctly, this grant type is only for using the resource
owner's credentials. What if we can't authorize using the resource owner
credentials, but need to authorize the client itself using the client id and secret alone?
For this, we need support for the "Client Credentials Grant". Is this planned
for Keycloak 1.0?
By adding the required "grant_type" parameter to the
"tokens/grants/access" service endpoint, it seems like both the
"password" and "client_credentials" could be supported, with the
"client_credentials" grant type simply not requiring the username and password
form parameters in the POST. Thoughts on this?
Thanks,
John