Hi Bruno,

3rd party APIs are treated as black boxes, so we cannot mess up with their code by adding keycloak.json and editing config files (also there is no guarantee they are deployed as WAR). That's why my first guess is some kind of a proxy.

Regards,
Pavel Maslov, MS

On Tue, May 17, 2016 at 4:38 PM, Bruno Oliveira <bruno@abstractj.org> wrote:

Hi Pavel, isn't something like this http://keycloak.github.io/docs/userguide/keycloak-server/html/ch08.html#d4e1006
enough?

On 2016-05-17, Pavel Maslov wrote:
> Hi all,
>
>
> Suppose we have a 3rd party REST API, which is not secured. How could we
> integrate OAuth2.0 authentication using Keycloak? My first guess is to
> create a mediation service (written in Java), which will use the Keycloak
> Java adapter and will authenticate users based off the security_token
> (passed to the mediation service with each request), and forward all
> requests (including headers) to the 3rd party REST API (unsecured).
>
> Does it make any sense? If so, has anyone written something similar?
>
> Thanks.
>
> Regards,
> Pavel Maslov, MS

> _______________________________________________
> keycloak-user mailing list
> keycloak-user@lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

--

abstractj
PGP: 0x84DC9914