9:47 a.m.
Hi Marek,
thanks for the quick response.
Do you have an ID for the Jira bug? I couldn't find it.
I must say I'm completely new to Keycloak and Kerberos etc.
I noticed, that the keycloak-authz-client uses an http-client under the
hood. Do I understand correctly, that the server still recognizes this type
of client as something different and uses the "Direct Grant" Authentication
flow and not the "Browser" flow?
So I would have to create a new Authenticator SPI implementation, that is
then deployed on the Keycloak server and integrated into the "Direct
Grant"-Flow to integrate Kerberos Authentication into this flow?
And do I also have to program something into the client?
Would it also be feasible to access Keycloak like a browser instead? Since
then Keycloak already supports Kerberos SSO, as far as I know.
Or why is the Fat Client using a completely different flow in the first
place?
Greetings,
Malte
On 7 June 2017 at 22:04, Marek Posolda <mposolda(a)redhat.com> wrote:
It's not yet supported OOTB. There is already JIRA opened for the
long
time. Feel free to add a vote :)
However it should be already possible to implement it if you write custom
authenticator and put it into the "Direct Grant Flow" authentication flow
for the realm. Then your Java Fat Client will be able to send the token in
the "Authorization: Negotiate token" header and your authenticator can then
authenticate this request. Feel free to send PR if you manage to have it
working.
See our docs and examples for Authentication SPI for more details.
Marek
On 07/06/17 15:13, Malte Finsterwalder wrote:
> Hi,
>
> I have the following setup:
>
> I'm programming a Java Fat Client application. I want to integrate it into
> SSO with Keycloak.
> Our Keycloak is connected to our Windows Active Directory (AD).
>
> So my idea is, that my Fat Client uses the Windows 7 Kerberos Token and
> sends that to Keycloak. Keycloak should authorize the token agains the AD
> and send back an authorization token to the Fat Client, so I can later use
> this Keycloak token to access other Rest-Services.
>
> Fat Client (with Kerberos Token) -> Keycloak -> AD
> Fat Client (with Keycloak Token) -> REST-Service
>
> I can't find anything in the documentation regarding this szenario.
> Is this possible? And if so, how?
>
> Greetings,
> Malte
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>