[keycloak-user] Generate offline token

Tue Nov 3 03:23:19 EST 2015

To create a token you need to have a client and a user (or service account
in which case you only need the client). Once you have that you can use the
browser based flow or obtain through REST (resource owner credential grant
for users, client credential grant for service accounts). You should not
share client and user between customers as that will stop you from being
able to revoke the offline tokens. Another issue is that tokens are fairly
big (it's not just a short key, it's a json document).

I would suggest you either:

* Create service account for customers - they can then use this to obtain a
token (offline or standard refresh) using REST endpoints on Keycloak
* Give offline token to users - in this case I would create a service
account for the customer and then create the offline token (all can be done
with Keycloak REST endpoints)

Take a look at
https://github.com/keycloak/keycloak/blob/master/examples/demo-template/admin-access-app/src/main/java/org/keycloak/example/AdminClient.java#L71
it shows how to obtain tokens without browser. To retrieve an offline token
just add scope=offline query parameter.

One thing you could do if you want to give customers the token is to create
a db that stores the token then send the customers a reference to the token
instead. You'd then need a proxy in front of your apps that can exchange
the reference for the full token. If you're interested in this approach I
can get you in touch with someone that is doing that.

On 2 November 2015 at 21:40, Pål Orby <orby at sendregning.no> wrote:

> It's not an option to create a client for each customer. Currently we have
> 65 000 customers, and we do not care if they use our API or using us within
> their browser.
>

> We want to just generate an offline token for a given user? Can someone
> please tell me how to do it. I've read the documentation, but it not clear
> for me how to obtain an offline token (
> http://keycloak.github.io/docs/userguide/keycloak-server/html/timeouts.html#offline-access
> ).
>

> Thanks in advance :-)
>
> /Pål
>
> *Pål Orby*
> UNIT4 Agresso AS
> Programvareingeniør
> Tlf: 22 58 85 00
> Mobil: 900 91 705
>
> SendRegning - Gjør det enkelt!
> http://www.sendregning.no
> http://facebook.com/sendregning
> http://twitter.com/sendregning
> http://faktura.no
>
> 2015-11-02 12:06 GMT+01:00 Stian Thorgersen <sthorger at redhat.com>:
>
>> I would create a client for each customer. Enable the service account
>> feature to map roles to the client. Then customers can authenticate either
>> with a secret or signed jwt (public/private key). They can then use the
>> client credentials grant to obtain tokens.
>> On 30 Oct 2015 15:37, "Pål Orby" <orby at sendregning.no> wrote:
>>
>>> Saw your session at JavaZone, so thought we could give KC a try :-)
>>>
>>> Our web application is split on two; frontend (HTML5/Javascript) and our
>>> backend (REST lv. 3 developed in Java, currently running inside Tomcat).
>>>
>>> Our frontend is just a consumer of our backend API (just like any other
>>> client), and I've successfully configured KC to use openid-connect/public
>>> for our frontend with keycloak.js, and openid-connect/bearer-only for our
>>> backend (API) in our test environment (sending the Authorization header
>>> with Bearer and keycloak.token to backend when doing ajax requests). This
>>> work like expected. Even written our own federation doing password
>>> validation from our user database.
>>>
>>> But, a lot of our customers have integrated their application to our
>>> backend API, doing REST calls for issuing invoices, etc...)
>>>
>>> Most other services that provides you with an API offers tokens that can
>>> be used for identification and authentication. And as far as I can see,
>>> this is offline tokens in KC.
>>>
>>> So we want to have our users log in to our service with their browser,
>>> go to our "API key page" and create a new token to be used by the
>>> integrations (moving away from Basic auth).
>>>
>>> I've created an offline token by hitting a keycloak protected html file
>>> and requested a resource with parameter ?scope=offline_access. I do see KC
>>> gives me a value back:
>>>
>>> http://localhost/keycloak.html?scope=offline_access&code=HU5UkZ_EbNUjX3Vhmg-3EIhC6Abz5rwhNMy_cuPzpLA.bfa6846d-b8f2-46da-b923-6a2824c82dd6&state=f2c410f3-37dd-4b5b-b933-1aacce916846
>>>
>>> But there is no way I can use this for anything (and in KC it seems to
>>> be bound to our frontend application).
>>>
>>> Why can't I use the admin rest api to say something like: give me an
>>> offline token for this user for this app?
>>>
>>> /Pål
>>>
>>> 2015-10-30 15:06 GMT+01:00 Stian Thorgersen <sthorger at redhat.com>:
>>>
>>>> Heisann,
>>>>
>>>> Nice to see fellow Norwegians are using Keycloak :)
>>>>
>>>> For offline tokens the idea is that you'd have a frontend app (server
>>>> or client, whichever floats your boat) that can bootstrap the offline token.
>>>>
>>>> Not sure offline tokens is quite what you need though - can you
>>>> elaborate a bit on your use case?
>>>>
>>>> On 30 October 2015 at 13:51, Pål Orby <orby at sendregning.no> wrote:
>>>>
>>>>> We have two clients registered in our realm; frontend and backend.
>>>>> Frontend is defined openid-connect/public (HTML/Javascript app) and backend
>>>>> is openid-connect/bearer-only.
>>>>>
>>>>> How can we generate an offline token for a given user that can be used
>>>>> towards our backend (which is bearer only)?
>>>>>
>>>>> We have a lot of customers that is integrated to our API (which is our
>>>>> backend client).
>>>>>
>>>>> *Pål Orby*
>>>>> UNIT4 Agresso AS
>>>>> DevOps
>>>>> Tlf: 22 58 85 00
>>>>> Mobil: 900 91 705
>>>>>
>>>>> SendRegning - Gjør det enkelt!
>>>>> http://www.sendregning.no
>>>>> http://facebook.com/sendregning
>>>>> http://twitter.com/sendregning
>>>>> http://faktura.no
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>>
>>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20151103/58fd33a0/attachment-0001.html 