[keycloak-user] Best Practices in Production environment

[Rakesh Alladi]

Hi All,

In terms of securing the REST Api,can someone please shed somelight on what
are the OIDC/OAuth Flow considerations one should consider that are at par
with Best Practices to be implemented in Production environment:

1. How should a REST service be secured and configured in Keycloak? Should
we use Access Type as "bearer-only" or "Confidential"
2. How should an Internal REST client is configured? Should we use "Offline
Access" or "Client Credentials"
3. How should an External REST client is configured? Should we use "Client
Credentials"

Any help on the above is much appreciated.

Thanks
Rakesh

-- 
IMPORTANT: The information contained in this message is intended only for 
the confidential use of the designated recipient. If the reader of this 
message is not the intended recipient or an agent responsible for 
delivering it to the intended recipient, you are hereby notified that you 
have received this document in error and that any review, dissemination, 
distribution or copying of this message is strictly prohibited. If you have 
received this communication in error, please notify us immediately and 
delete this message and any attachments from your computer. Thank you.