Heisann, Nice to see fellow Norwegians are using Keycloak :) For offline tokens the idea is that you'd have a frontend app (server or client, whichever floats your boat) that can bootstrap the offline token. Not sure offline tokens is quite what you need though - can you elaborate a bit on your use case? On 30 October 2015 at 13:51, Pål Orby <orby(a)sendregning.no&gt; wrote: > We have two clients registered in our realm; frontend and backend. > Frontend is defined openid-connect/public (HTML/Javascript app) and backend > is openid-connect/bearer-only. > > How can we generate an offline token for a given user that can be used > towards our backend (which is bearer only)? > > We have a lot of customers that is integrated to our API (which is our > backend client). > > *Pål Orby* > UNIT4 Agresso AS > DevOps > Tlf: 22 58 85 00 > Mobil: 900 91 705 > > SendRegning - Gjør det enkelt! > http://www.sendregning.no > http://facebook.com/sendregning > http://twitter.com/sendregning > http://faktura.no > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >

Saw your session at JavaZone, so thought we could give KC a try :-) Our web application is split on two; frontend (HTML5/Javascript) and our backend (REST lv. 3 developed in Java, currently running inside Tomcat). Our frontend is just a consumer of our backend API (just like any other client), and I've successfully configured KC to use openid-connect/public for our frontend with keycloak.js, and openid-connect/bearer-only for our backend (API) in our test environment (sending the Authorization header with Bearer and keycloak.token to backend when doing ajax requests). This work like expected. Even written our own federation doing password validation from our user database. But, a lot of our customers have integrated their application to our backend API, doing REST calls for issuing invoices, etc...) Most other services that provides you with an API offers tokens that can be used for identification and authentication. And as far as I can see, this is offline tokens in KC. So we want to have our users log in to our service with their browser, go to our "API key page" and create a new token to be used by the integrations (moving away from Basic auth). I've created an offline token by hitting a keycloak protected html file and requested a resource with parameter ?scope=offline_access. I do see KC gives me a value back: http://localhost/keycloak.html?scope=offline_access&code=HU5UkZ_EbNUj... But there is no way I can use this for anything (and in KC it seems to be bound to our frontend application). Why can't I use the admin rest api to say something like: give me an offline token for this user for this app? /Pål 2015-10-30 15:06 GMT+01:00 Stian Thorgersen <sthorger(a)redhat.com&gt;: > Heisann, > > Nice to see fellow Norwegians are using Keycloak :) > > For offline tokens the idea is that you'd have a frontend app (server or > client, whichever floats your boat) that can bootstrap the offline token. > > Not sure offline tokens is quite what you need though - can you elaborate > a bit on your use case? > > On 30 October 2015 at 13:51, Pål Orby <orby(a)sendregning.no&gt; wrote: > >> We have two clients registered in our realm; frontend and backend. >> Frontend is defined openid-connect/public (HTML/Javascript app) and backend >> is openid-connect/bearer-only. >> >> How can we generate an offline token for a given user that can be used >> towards our backend (which is bearer only)? >> >> We have a lot of customers that is integrated to our API (which is our >> backend client). >> >> *Pål Orby* >> UNIT4 Agresso AS >> DevOps >> Tlf: 22 58 85 00 >> Mobil: 900 91 705 >> >> SendRegning - Gjør det enkelt! >> http://www.sendregning.no >> http://facebook.com/sendregning >> http://twitter.com/sendregning >> http://faktura.no >> >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > >

It's not an option to create a client for each customer. Currently we have 65 000 customers, and we do not care if they use our API or using us within their browser. We want to just generate an offline token for a given user? Can someone please tell me how to do it. I've read the documentation, but it not clear for me how to obtain an offline token (http://keycloak.github.io/docs/userguide/keycloak-server/html/timeouts.ht...).

Thanks in advance :-) /Pål *Pål Orby* UNIT4 Agresso AS* *Programvareingeniør Tlf: 22 58 85 00 Mobil: 900 91 705 SendRegning - Gjør det enkelt! http://www.sendregning.no http://facebook.com/sendregning http://twitter.com/sendregning http://faktura.no 2015-11-02 12:06 GMT+01:00 Stian Thorgersen <sthorger(a)redhat.com <mailto:sthorger@redhat.com>>: I would create a client for each customer. Enable the service account feature to map roles to the client. Then customers can authenticate either with a secret or signed jwt (public/private key). They can then use the client credentials grant to obtain tokens. On 30 Oct 2015 15:37, "Pål Orby" <orby(a)sendregning.no <mailto:orby@sendregning.no>> wrote: Saw your session at JavaZone, so thought we could give KC a try :-) Our web application is split on two; frontend (HTML5/Javascript) and our backend (REST lv. 3 developed in Java, currently running inside Tomcat). Our frontend is just a consumer of our backend API (just like any other client), and I've successfully configured KC to use openid-connect/public for our frontend with keycloak.js, and openid-connect/bearer-only for our backend (API) in our test environment (sending the Authorization header with Bearer and keycloak.token to backend when doing ajax requests). This work like expected. Even written our own federation doing password validation from our user database. But, a lot of our customers have integrated their application to our backend API, doing REST calls for issuing invoices, etc...) Most other services that provides you with an API offers tokens that can be used for identification and authentication. And as far as I can see, this is offline tokens in KC. So we want to have our users log in to our service with their browser, go to our "API key page" and create a new token to be used by the integrations (moving away from Basic auth). I've created an offline token by hitting a keycloak protected html file and requested a resource with parameter ?scope=offline_access. I do see KC gives me a value back: http://localhost/keycloak.html?scope=offline_access&code=HU5UkZ_EbNUj... But there is no way I can use this for anything (and in KC it seems to be bound to our frontend application). Why can't I use the admin rest api to say something like: give me an offline token for this user for this app? /Pål 2015-10-30 15:06 GMT+01:00 Stian Thorgersen <sthorger(a)redhat.com <mailto:sthorger@redhat.com>>: Heisann, Nice to see fellow Norwegians are using Keycloak :) For offline tokens the idea is that you'd have a frontend app (server or client, whichever floats your boat) that can bootstrap the offline token. Not sure offline tokens is quite what you need though - can you elaborate a bit on your use case? On 30 October 2015 at 13:51, Pål Orby <orby(a)sendregning.no <mailto:orby@sendregning.no>> wrote: We have two clients registered in our realm; frontend and backend. Frontend is defined openid-connect/public (HTML/Javascript app) and backend is openid-connect/bearer-only. How can we generate an offline token for a given user that can be used towards our backend (which is bearer only)? We have a lot of customers that is integrated to our API (which is our backend client). *Pål Orby* UNIT4 Agresso AS* *DevOps Tlf: 22 58 85 00 Mobil: 900 91 705 SendRegning - Gjør det enkelt! http://www.sendregning.no http://facebook.com/sendregning http://twitter.com/sendregning http://faktura.no _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-user _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

* Create service account for customers - they can then use this to obtain a token (offline or standard refresh) using REST endpoints on Keycloak

On 03/11/15 09:32, Thomas Raehalme wrote: On Tue, Nov 3, 2015 at 10:23 AM, Stian Thorgersen < <sthorger(a)redhat.com&gt; sthorger(a)redhat.com&gt; wrote: > * Create service account for customers - they can then use this to obtain > a token (offline or standard refresh) using REST endpoints on Keycloak > Sorry to step in, but could you please explain the use case or the reasoning for offline tokens on service accounts? If I have understood it correctly you'll still need clientId and secret to generate the access token from the offline token. Why not just use them to login whenever necessary? Thanks! We support offline tokens for service accounts because there is no reason (bad side effect) of not supporting it. Or at least I am not aware of any. Are you? Adding this support came "for free". One usecase when it can be useful is, for example if you have offline token and you don't know how was this offline token authenticated (if it was direct grant, service account or browser). You can send the refresh token request with this token regardless of the offline token type as the refreshToken endpoint is same for all cases. Marek Best regards, Thomas _______________________________________________ keycloak-user mailing listkeycloak-user@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user

Ok, so after reading the replies here I understand that it isn't offline tokens I'm looking for. The token I'm looking for is what I would call an "application token". Any plans implementing that?

Example: If you enable two factor authentication on Github, you can't connect with username/password anymore in terminal or other 3. party applications integrated with GitHub without using an "application token" that you create on your GitHub account page. /Pål *Pål Orby* UNIT4 Agresso AS Programvareingeniør Tlf: 22 58 85 00 Mobil: 900 91 705 SendRegning - Gjør det enkelt! http://www.sendregning.no http://facebook.com/sendregning http://twitter.com/sendregning http://faktura.no 2015-11-03 13:49 GMT+01:00 Marek Posolda <mposolda(a)redhat.com&gt;: > On 03/11/15 09:32, Thomas Raehalme wrote: > > On Tue, Nov 3, 2015 at 10:23 AM, Stian Thorgersen < <sthorger(a)redhat.com&gt; > sthorger(a)redhat.com&gt; wrote: > >> * Create service account for customers - they can then use this to >> obtain a token (offline or standard refresh) using REST endpoints on >> Keycloak >> > > Sorry to step in, but could you please explain the use case or the > reasoning for offline tokens on service accounts? If I have understood it > correctly you'll still need clientId and secret to generate the access > token from the offline token. Why not just use them to login whenever > necessary? Thanks! > > We support offline tokens for service accounts because there is no reason > (bad side effect) of not supporting it. Or at least I am not aware of any. > Are you? Adding this support came "for free". > > One usecase when it can be useful is, for example if you have offline > token and you don't know how was this offline token authenticated (if it > was direct grant, service account or browser). You can send the refresh > token request with this token regardless of the offline token type as the > refreshToken endpoint is same for all cases. > > Marek > > > Best regards, > Thomas > > > > > _______________________________________________ > keycloak-user mailing listkeycloak-user@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user > > >

On Tue, Nov 3, 2015 at 10:23 AM, Stian Thorgersen <sthorger(a)redhat.com&gt; wrote: > * Create service account for customers - they can then use this to obtain > a token (offline or standard refresh) using REST endpoints on Keycloak > Sorry to step in, but could you please explain the use case or the reasoning for offline tokens on service accounts? If I have understood it correctly you'll still need clientId and secret to generate the access token from the offline token. Why not just use them to login whenever necessary? Thanks!

Best regards, Thomas