You're confusion is probably around the term "Client". The existing X509 feature was for *user* authentication, the new feature is to authenticate a Keycloak *Clients* (meaning an application/service ) with x509 certificate, like we already did with secret or Signed JWT ( https://www.keycloak.org/docs/latest/server_admin/index.html#_client-cred...). On Wed, Oct 3, 2018 at 2:33 PM Meissa M'baye Sakho <msakho(a)redhat.com&gt; wrote: > Hello Everyone, > I'm wondering about the difference between the newly released featureX509 > Client Authenticator in the 4.3 version and the x509 Client *Certificate* > Authentication that has been released for a while. > > I know that the x509 Client *Certificate* Authentication when enabled will > allow user to authenticate upon a client certificate. They will then > don't > need to give a login/password. > > But I don't see the x509 Client Authentication description somewhere. > > Any input? > Regards, > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >