12:14 p.m.
If you want the database service to redirect users to the login page, it must be changed
to confidential. If the front end itself is a client of Keycloak, then leaving the service
as bearer only is fine.
The example is obviously a bit contrived but the idea was that no user, even an admin,
would authenticate directly to the database service. If there were to be an admin
interface for the database, it would be another client in the same realm. Ultimately it’s
a design decision you have to make when you consider what works well for your
organization.
Scott Rossillo
Smartling | Senior Software Engineer
srossillo(a)smartling.com
<http://www.sigstr.com/>
On Jan 5, 2016, at 10:30 AM, Amaeztu <amaeztu(a)tesicnor.com>
wrote:
Well, this example answers the asked question, so many thanks Scott. However, I still
have some doubts.
In the given code, the database service can only be accessed from another client (bearer
only). However, let's suppose I also want to have access to its endpoints from a Web
browser, for pure administrative purpose and only with the ADMIN role. I should change the
access to confidential. Then I want to access the service from the customer app, but,
since the current user role might not be ADMIN, I wouldn't be authorized for the
remote access.
The only solution I can think for this is to keep the database service access bearer only
and implement a specific database-ui service, which should replicate all the original
endpoints (this involves adding a new endpoint to the ui service everytime I do it in the
db service).
Is there a way for solving this which avoids having an specific ui service implemented?
Sorry about all questions I'm still a starter!
Nire Sony Xperia™ telefonotik bidalita
---- Scott Rossillo igorleak idatzi du ----
Take a look at these Spring samples. It's set up automatically:
https://github.com/foo4u/keycloak-spring-demo/blob/master/customer-app/sr...
<https://github.com/foo4u/keycloak-spring-demo/blob/master/customer-app/sr...
On Tue, Dec 29, 2015 at 12:31 PM Aritz Maeztu <amaeztu(a)tesicnor.com
<mailto:amaeztu@tesicnor.com>> wrote:
At this moment there's a KeycloakRestTemplate to use it in Spring which allows an end
user to retrieve data from other keycloak clients. However, a client might also be
interested in accessing data with its own permissions and with no user interaction. Is
there any implementation of a RestTemplate to utilize client service accounts and, if not,
are there any plans to write it? This demo
<https://github.com/keycloak/keycloak/blob/master/examples/demo-template/s...
to do it manually.
Regards
--
Aritz Maeztu Otaño
Departamento Desarrollo de Software
<https://www.linkedin.com/profile/preview?vpa=pub&locale=es_ES>
<http://www.tesicnor.com/>
Pol. Ind. Mocholi. C/Rio Elorz, Nave 13E 31110 Noain (Navarra)
Telf.: 948 21 40 40
Fax.: 948 21 40 41
Antes de imprimir este e-mail piense bien si es necesario hacerlo: El medioambiente es
cosa de todos. _______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
<https://lists.jboss.org/mailman/listinfo/keycloak-user><logo.png>...
