Hi Stian and Bill, I've posted some questions regarding this topic before but I thought I'd start a new thread to keep things focused: I'm writing an AngularJS application with Java EE 6/7 REST (JAX-RS) backend modules. To add authentication and authorization to this application, I'd like to use keycloak * as a user and role management front-end * to provide a customizable login page (works very well by the way ;) * as an OAuth 2.0 token provider * to add user and role information to the HTTPRequests in my REST/ backend modules To do this, I'm currently looking at keycloak.js and the customer-app-js example. However, I'm wondering whether this is really the best way to go. In a reply to an earlier post of mine you mentioned that the keycloak admin console is written in AngularJS and that you are using HTTP-only cookies there. However, in keycloak.js and the customer-app-js example you are retrieving the token in the JS app and adding an authorization header with a bearer token to the HTTP requests. So here are my questions: * Is there a reason you are using two different approaches in the admin console and the official demo app? * which one of the two approaches (bearer tokens vs. HTTP-only cookie) will you support/ will be the officially recommended one for HTML5/ client side JavaScript applications in keycloak? * am I right in assuming that you haven't quite decided yet which approach to use and that you are still discussing this in the keycloak team? Looking forwards to your reply! Cheers, Nils _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Personally, I think that in most cases for a client-side web app the best approach is to let the client-side do the oauth flow (the approach we're currently taking in keycloak.js). It does depend on your application though, and if you're application has a strict one html5 app calls one REST service then http-only cookies are an option. I don't see any real benefits of it though, and I believe it significantly complicates things. Have a look at http://blog.auth0.com/2014/01/07/angularjs-authentication-with-cookies-vs..., I think it provides a good summary of the pros of the token approach. ----- Original Message ----- > From: "Bill Burke" <bburke(a)redhat.com&gt; > To: keycloak-user(a)lists.jboss.org > Sent: Thursday, 27 March, 2014 3:39:07 PM > Subject: Re: [keycloak-user] Keycloak and AngularJS > > What I like about the current admin console approach is that there is no > book keeping required by the browser. The Angular app has really no > knowledge of how it is being secured as its all driven by the server. > Also, you need to remember that the admin console was designed to be run > in a non-Java EE, non-servlet environment. While this is a requirement > for Keycloak, it may not be for your application. So, what I'm saying > is that for your angular application, you could rely on the servlet > container and keycloak adapter to maintain a session cookie and identity. > > What I like about the keycloak.js approach is that there is no > server-side adapter required for the UI. The UI could be hosted off any > number of static web sites and use CORS invocations to any number of > Restful services. > > There's also the debate of public vs. confidential clients. The > keycloak.js approach requires a public client. My understanding was > that confidential clients exist so that only an authenticated client > (client *NOT* user) is able to obtain an access token. I'm not exactly > sure what additional security benefits are obtained here beyond this. > I've been trying to ask this very question on OAuth mail lists but have > been unable to get a response so far. > > > > On 3/27/2014 10:41 AM, Nils Preusker wrote: > > Hi Stian and Bill, > > > > I've posted some questions regarding this topic before but I thought I'd > > start a new thread to keep things focused: > > > > I'm writing an AngularJS application with Java EE 6/7 REST (JAX-RS) > > backend modules. To add authentication and authorization to this > > application, I'd like to use keycloak > > > > * as a user and role management front-end > > * to provide a customizable login page (works very well by the way ;) > > * as an OAuth 2.0 token provider > > * to add user and role information to the HTTPRequests in my REST/ > > backend modules > > > > To do this, I'm currently looking at keycloak.js and the customer-app-js > > example. However, I'm wondering whether this is really the best way to > > go. In a reply to an earlier post of mine you mentioned that the > > keycloak admin console is written in AngularJS and that you are using > > HTTP-only cookies there. > > > > However, in keycloak.js and the customer-app-js example you are > > retrieving the token in the JS app and adding an authorization header > > with a bearer token to the HTTP requests. > > > > So here are my questions: > > > > * Is there a reason you are using two different approaches in the admin > > console and the official demo app? > > * which one of the two approaches (bearer tokens vs. HTTP-only cookie) > > will you support/ will be the officially recommended one for HTML5/ > > client side JavaScript applications in keycloak? > > * am I right in assuming that you haven't quite decided yet which > > approach to use and that you are still discussing this in the keycloak > > team? > > > > Looking forwards to your reply! > > Cheers, > > Nils > > > > > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user > _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user