[keycloak-user] Temporary support for current sign-in flow

As everyone is probably painfully aware from all of my questions, we are in the midst of replacing our proprietary login flow with a Keycloak OpenID-based flow. The eventual goal is to use the standard Keycloak login pages to allow for extra factors of authentication such as Google Authenticator. One option that we've allowed until now is for customers to host custom login HTML forms (just username and password) on their sites. This is something that we are (most likely) going to remove support for in the long run, but in the short term, I think we are going to need to support this if only to allow for a transition period. The login flow is: Customer Site (HTML form) -> Login Handler (JEE Session) -> Redirect browser to SPA along with JSESSIONID All API calls use JEE sessions for "authentication". What I'm hoping to do somehow in the short term is: Customer Site (HTML form) -> Login Handler -> Keycloak -> Redirect browser to SPA with OAuth codes/tokens What is the best/correct way to do something like this? Should I be using the authorization code grant in this case? Thanks for any insights. Craig ================================= *Craig Setera* *Chief Technology Officer*