12:09 p.m.
Hi all,
I'm trying to figure out how I could use keycloak to secure a REST API that
is used bu a pure backend REST client. Do you have any recommendations for
that (i.e. API keys)?
Cheers,
Nils
3:30 a.m.
To clarify, I've been looking at the various clients in the examples and
know that I can simply add an authorization header with a bearer token to
the REST requests. However, as far as I understand the examples and the
code, all the login flows are based on login forms and redirects. While
this is convenient for web applications, I'm missing a simple way for a
"headless" client to obtain a token in return for application credentials
or an API key. Are you planning to support this kind of use case?
Cheers,
Nils
On Sat, Apr 12, 2014 at 7:09 PM, Nils Preusker <n.preusker(a)gmail.com> wrote:
Hi all,
I'm trying to figure out how I could use keycloak to secure a REST API
that is used bu a pure backend REST client. Do you have any recommendations
for that (i.e. API keys)?
Cheers,
Nils
2:26 a.m.
Hi,
I would suggest to look at this endpoint
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o...
. I wonder that this is something you are looking for as it allows to
retrieve token for some user in exchange to application and user
credentials. It's defacto something described in OAuth2 specs in
Resource Owner flow http://tools.ietf.org/html/rfc6749#page-37 .
So what I've just tried is this curl request:
curl --request POST
http://localhost:8081/auth/rest/realms/myRealm/tokens/grants/access
--data
"client_id=myApp&client_secret=c52dc243-8004-4843-b03b-bc139fd3a6fc&username=john&password=password"
--header "Accept: application/json" --header "Content-type:
application/x-www-form-urlencoded"
where client_id and client_secret are credentials of my application and
username/password are credentials of user and "myRealm" is name of my
realm where user "john" and application "myApp" are registered. Note
that instead of client_id and client_secret you can also use
Authorization header (see the code for more details)
Marek
On 13.4.2014 10:30, Nils Preusker wrote:
To clarify, I've been looking at the various clients in the
examples
and know that I can simply add an authorization header with a bearer
token to the REST requests. However, as far as I understand the
examples and the code, all the login flows are based on login forms
and redirects. While this is convenient for web applications, I'm
missing a simple way for a "headless" client to obtain a token in
return for application credentials or an API key. Are you planning to
support this kind of use case?
Cheers,
Nils
On Sat, Apr 12, 2014 at 7:09 PM, Nils Preusker <n.preusker(a)gmail.com
<mailto:n.preusker@gmail.com>> wrote:
Hi all,
I'm trying to figure out how I could use keycloak to secure a REST
API that is used bu a pure backend REST client. Do you have any
recommendations for that (i.e. API keys)?
Cheers,
Nils
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
4:36 a.m.
Thanks Marek, I'll look into that!
Nils
On Mon, Apr 14, 2014 at 9:26 AM, Marek Posolda <mposolda(a)redhat.com> wrote:
Hi,
I would suggest to look at this endpoint
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o....
I wonder that this is something you are looking for as it allows to
retrieve token for some user in exchange to application and user
credentials. It's defacto something described in OAuth2 specs in Resource
Owner flow http://tools.ietf.org/html/rfc6749#page-37 .
So what I've just tried is this curl request:
curl --request POST
http://localhost:8081/auth/rest/realms/myRealm/tokens/grants/access--data
"client_id=myApp&client_secret=c52dc243-8004-4843-b03b-bc139fd3a6fc&username=john&password=password"
--header "Accept: application/json" --header "Content-type:
application/x-www-form-urlencoded"
where client_id and client_secret are credentials of my application and
username/password are credentials of user and "myRealm" is name of my realm
where user "john" and application "myApp" are registered. Note that
instead
of client_id and client_secret you can also use Authorization header (see
the code for more details)
Marek
On 13.4.2014 10:30, Nils Preusker wrote:
To clarify, I've been looking at the various clients in the examples and
know that I can simply add an authorization header with a bearer token to
the REST requests. However, as far as I understand the examples and the
code, all the login flows are based on login forms and redirects. While
this is convenient for web applications, I'm missing a simple way for a
"headless" client to obtain a token in return for application credentials
or an API key. Are you planning to support this kind of use case?
Cheers,
Nils
On Sat, Apr 12, 2014 at 7:09 PM, Nils Preusker <n.preusker(a)gmail.com>wrote:
> Hi all,
>
> I'm trying to figure out how I could use keycloak to secure a REST API
> that is used bu a pure backend REST client. Do you have any recommendations
> for that (i.e. API keys)?
>
> Cheers,
> Nils
>
_______________________________________________
keycloak-user mailing
listkeycloak-user@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
8:32 a.m.
Bearer token security. Take a look at the examples, specifically the
database-service. This is a pure REST service secured by keyloak.
At the moment, we only have support for JBoss/Wildfly, but it wouldn't
take much to write an adapter for another java environment.
On 4/12/2014 1:09 PM, Nils Preusker wrote:
Hi all,
I'm trying to figure out how I could use keycloak to secure a REST API
that is used bu a pure backend REST client. Do you have any
recommendations for that (i.e. API keys)?
Cheers,
Nils
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
9:34 a.m.
Hi Bill,
I'm familiar with the examples, however I'm looking for a way to grant
third-party clients access to my API. Since they could be written in a
variety of languages, I'd like them to be able to obtain a token in a
defined way without being dependent on Keycloak.
I suppose the approach Marek mentioned (OAuth spec section 4.3) should do
the trick though (as long as you are planning to continue supporting it).
Cheers,
Nils
On Mon, Apr 14, 2014 at 3:32 PM, Bill Burke <bburke(a)redhat.com> wrote:
Bearer token security. Take a look at the examples, specifically
the
database-service. This is a pure REST service secured by keyloak.
At the moment, we only have support for JBoss/Wildfly, but it wouldn't
take much to write an adapter for another java environment.
On 4/12/2014 1:09 PM, Nils Preusker wrote:
> Hi all,
>
> I'm trying to figure out how I could use keycloak to secure a REST API
> that is used bu a pure backend REST client. Do you have any
> recommendations for that (i.e. API keys)?
>
> Cheers,
> Nils
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
9:39 a.m.
You could use section 4.1 (Auth code grant) or 4.3 (Resource Owner
Password Credentials Grant) with any OAuth library. 4.1 will require a
browser. 4.3 doesn't.
We will always support OAuth 2.0 through OpenID Connect.
On 4/14/2014 10:34 AM, Nils Preusker wrote:
Hi Bill,
I'm familiar with the examples, however I'm looking for a way to grant
third-party clients access to my API. Since they could be written in a
variety of languages, I'd like them to be able to obtain a token in a
defined way without being dependent on Keycloak.
I suppose the approach Marek mentioned (OAuth spec section 4.3) should
do the trick though (as long as you are planning to continue supporting it).
Cheers,
Nils
On Mon, Apr 14, 2014 at 3:32 PM, Bill Burke <bburke(a)redhat.com
<mailto:bburke@redhat.com>> wrote:
Bearer token security. Take a look at the examples, specifically the
database-service. This is a pure REST service secured by keyloak.
At the moment, we only have support for JBoss/Wildfly, but it wouldn't
take much to write an adapter for another java environment.
On 4/12/2014 1:09 PM, Nils Preusker wrote:
> Hi all,
>
> I'm trying to figure out how I could use keycloak to secure a
REST API
> that is used bu a pure backend REST client. Do you have any
> recommendations for that (i.e. API keys)?
>
> Cheers,
> Nils
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
11:14 a.m.
Hi Bill,
ok, so 4.3 seems to be the way to go for us. Did I understand you correctly
that keycloak will continue to support this?
Cheers,
Nils
On Mon, Apr 14, 2014 at 4:39 PM, Bill Burke <bburke(a)redhat.com> wrote:
You could use section 4.1 (Auth code grant) or 4.3 (Resource Owner
Password Credentials Grant) with any OAuth library. 4.1 will require a
browser. 4.3 doesn't.
We will always support OAuth 2.0 through OpenID Connect.
On 4/14/2014 10:34 AM, Nils Preusker wrote:
> Hi Bill,
>
> I'm familiar with the examples, however I'm looking for a way to grant
> third-party clients access to my API. Since they could be written in a
> variety of languages, I'd like them to be able to obtain a token in a
> defined way without being dependent on Keycloak.
>
> I suppose the approach Marek mentioned (OAuth spec section 4.3) should
> do the trick though (as long as you are planning to continue supporting
it).
>
> Cheers,
> Nils
>
>
> On Mon, Apr 14, 2014 at 3:32 PM, Bill Burke <bburke(a)redhat.com
> <mailto:bburke@redhat.com>> wrote:
>
> Bearer token security. Take a look at the examples, specifically the
> database-service. This is a pure REST service secured by keyloak.
>
> At the moment, we only have support for JBoss/Wildfly, but it
wouldn't
> take much to write an adapter for another java environment.
>
> On 4/12/2014 1:09 PM, Nils Preusker wrote:
> > Hi all,
> >
> > I'm trying to figure out how I could use keycloak to secure a
> REST API
> > that is used bu a pure backend REST client. Do you have any
> > recommendations for that (i.e. API keys)?
> >
> > Cheers,
> > Nils
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user(a)lists.jboss.org <mailto:
keycloak-user(a)lists.jboss.org>
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
3:09 p.m.
Yes.
On 4/14/2014 12:14 PM, Nils Preusker wrote:
Hi Bill,
ok, so 4.3 seems to be the way to go for us. Did I understand you
correctly that keycloak will continue to support this?
Cheers,
Nils
On Mon, Apr 14, 2014 at 4:39 PM, Bill Burke <bburke(a)redhat.com
<mailto:bburke@redhat.com>> wrote:
You could use section 4.1 (Auth code grant) or 4.3 (Resource Owner
Password Credentials Grant) with any OAuth library. 4.1 will require a
browser. 4.3 doesn't.
We will always support OAuth 2.0 through OpenID Connect.
On 4/14/2014 10:34 AM, Nils Preusker wrote:
> Hi Bill,
>
> I'm familiar with the examples, however I'm looking for a way to
grant
> third-party clients access to my API. Since they could be written
in a
> variety of languages, I'd like them to be able to obtain a token in a
> defined way without being dependent on Keycloak.
>
> I suppose the approach Marek mentioned (OAuth spec section 4.3)
should
> do the trick though (as long as you are planning to continue
supporting it).
>
> Cheers,
> Nils
>
>
> On Mon, Apr 14, 2014 at 3:32 PM, Bill Burke <bburke(a)redhat.com
<mailto:bburke@redhat.com>
> <mailto:bburke@redhat.com <mailto:bburke@redhat.com>>> wrote:
>
> Bearer token security. Take a look at the examples,
specifically the
> database-service. This is a pure REST service secured by
keyloak.
>
> At the moment, we only have support for JBoss/Wildfly, but it
wouldn't
> take much to write an adapter for another java environment.
>
> On 4/12/2014 1:09 PM, Nils Preusker wrote:
> > Hi all,
> >
> > I'm trying to figure out how I could use keycloak to secure a
> REST API
> > that is used bu a pure backend REST client. Do you have any
> > recommendations for that (i.e. API keys)?
> >
> > Cheers,
> > Nils
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user(a)lists.jboss.org
<mailto:keycloak-user@lists.jboss.org>
<mailto:keycloak-user@lists.jboss.org
<mailto:keycloak-user@lists.jboss.org>>
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
<mailto:keycloak-user@lists.jboss.org>
<mailto:keycloak-user@lists.jboss.org
<mailto:keycloak-user@lists.jboss.org>>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
3792
days inactive
3794
days old
8 comments
3 participants
participants (3)
-
Bill Burke -
Marek Posolda -
Nils Preusker