I have a suite of spring applications that are using keycloak for authentication. I'm using the Keycloak spring security adapter and have my successfully secured the endpoints that I want to. I have situations where I need Application A to make a call to a secured endpoint on Application B. I am able to do this client to client communication by using the KeycloakRestTemplate but only when a user calls Application A with a valid token. Application A also has a process that will call Application B without user interaction. When this is done I get an error "java.lang.IllegalStateException: Cannot set authorization header because there is no authenticated principal". This makes sense since I don't have a valid user token. Application A and Application B use the same client in keycloak and it is set to be a confidential client. I have tried it with and without having service accounts enabled.

Some questions I have are: 1. How do I have applications (not users) call a secured REST endpoint? 2. Do the provided keycloak adapters (like the spring security adapter) provide this functionality? 3. Do I need an additional client account to do this? 4. Are there any libraries that handle refreshing these tokens or automatically obtaining one if it doesn't exist? I see lots of examples on how a user can access a secured service, but not much on an application accessing a secured service. _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Yes, I was looking at that guide. I knew how to go to the keycloak token endpoint and get a token. I wasn't sure if this is the way it needed to be done, or if It could be done through the provided adapters. When the adapters are already being used, and it knows of your client and secret already, it seemed like a lot of overhead to go out to keycloak some other way and make sure that token is not expired (along with re-issuing a token logic), then make the call. If this is the required way, that's fine. ------------------------------ *From:* Sebastien Blanc <sblanc(a)redhat.com&gt; *Sent:* Thursday, December 1, 2016 3:45 PM *To:* Matt H *Cc:* keycloak-user(a)lists.jboss.org *Subject:* Re: [keycloak-user] How to access secured REST endpoint from keycloak-spring-security-adapter (including mailing list) On Thu, Dec 1, 2016 at 8:31 PM, Matt H <tsdgcc2087(a)outlook.com&gt; wrote: > I have a suite of spring applications that are using keycloak for > authentication. I'm using the Keycloak spring security adapter and have my > successfully secured the endpoints that I want to. I have situations where > I need Application A to make a call to a secured endpoint on Application > B. I am able to do this client to client communication by using the > KeycloakRestTemplate but only when a user calls Application A with a valid > token. > > > Application A also has a process that will call Application B without > user interaction. When this is done I get an error > "java.lang.IllegalStateException: Cannot set authorization header > because there is no authenticated principal". This makes sense since I > don't have a valid user token. > > > Application A and Application B use the same client in keycloak and it is > set to be a confidential client. I have tried it with and without having > service accounts enabled. > When you say "with service accounts enabled", have you followed all the instructions from here https://keycloak.gitbooks.io/s erver-adminstration-guide/content/topics/clients/oidc/servic e-accounts.html , meaning also calling the /{server-root-usualy-auth}/rea lms/{realm-name}/protocol/openid-connect/token endpoint in order to retrieve a valid token ? > > > Some questions I have are: > > 1. How do I have applications (not users) call a secured REST endpoint? > > 2. Do the provided keycloak adapters (like the spring security adapter) > provide this functionality? > > 3. Do I need an additional client account to do this? > > 4. Are there any libraries that handle refreshing these tokens or > automatically obtaining one if it doesn't exist? > > > I see lots of examples on how a user can access a secured service, but > not much on an application accessing a secured service. > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >