Hello guys,
we ´re using the
„Direct Grant Access” flow described in chapter 15 in the
keycloak users documentation. As we understood, the
following steps are necessary:
1.: Do the token
request with “username/password” and “grant_type=password”
to the token server (keycloak).
2.: The token response
from keycloak contains an “access_token” and a
“refresh_token”.
3.: Normally, the
client uses the “access_token” within the HTTP-Header
(Authorization Bearer *access_token*) to do the
authentication.
Everything works as
expected. We have found that you can also use the
“refresh_token” instead of the “access_token” in step 3 to
do the authentication and it will be still successful.
From our point of view, this is possible, because the
keycloak-wildfly-security-module does not check the
token-type. But, from our understanding the
“refresh_token” is not intended to do the authentication,
so this should not work, right? So my two questions are:
1.: Why is the
authentication with the “refresh_token” successful?