For your first question, with OIDC there are three types of clients: confidential, public
and bearer-only. For simplicity, let’s consider confidential, public as applications that
you log into, for example, an e-commerce website. These applications have a session which
stores the access token, ID token, and refresh token. When a request comes into the
website the application, the session ID is used to establish who you are. This could mean
making your OIDC tokens accessible to server side code.
A bearer-only application does not use sessions. It expects the OIDC access token to be
sent in the authorization HTTP header on every request. It is a stateless application.
Continuing your example, let’s say your e-commerce website needs to call a service that
provides up to date inventory information when a user adds an item to cart. This can be a
stateless service but wants to know what user is requesting inventory. The e-commerce
website could retrieve the access token from the session and query the bearer-only
application.
This is just one example, and a bit of an oversimplification of the things a confidential
and public client can do. However, the point I’m trying to make is that by defining a
client as bearer-only you are essentially saying it’s a stateless service that requires an
OIDC access token on every request.
Scott Rossillo
Smartling | Senior Software Engineer
srossillo(a)smartling.com
On Jul 29, 2016, at 9:18 AM, Mohan.Radhakrishnan(a)cognizant.com
wrote:
Hi,
I have some doubts. I am using spring boot. The servlet filter adapter
actually uses sessions. Is that right ? I was thinking the token will be required for
every Rest endpoint access. But unless I clear jsessionid it is not required. Have I
understood this correctly ?
How do I get the claims from my implicit token ? Do I need the spring boot adapter ? Can
I see an example combining implicit token and boot adapter ?
Thanks,
Mohan
This e-mail and any files transmitted with it are for the sole use of the intended
recipient(s) and may contain confidential and privileged information. If you are not the
intended recipient(s), please reply to the sender and destroy all copies of the original
message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or
copying of this email, and/or any action taken in reliance on the contents of this e-mail
is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail
and other e-mail communications sent to and from Cognizant e-mail addresses may be
monitored. _______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
<
https://lists.jboss.org/mailman/listinfo/keycloak-user>