springboot 获取令牌以调用另一个服务

Question

I want to make GET request from SpringBoot. Can I use org.keycloak.admin.client.Keycloak only to get and refresh token to access an API in another microservice? I thouth it is only for manage, for adding roles etc. Not for authorization.

        keycloak = KeycloakBuilder
            .builder()
            .serverUrl(serverUrl)
            .grantType(OAuth2Constants.PASSWORD)
            .realm(realm)
            .clientId(clientId)
            .username(userName)
            .password(pass)
            .build();

    AccessTokenResponse accessToken = keycloak.tokenManager().getAccessToken();

It works but still I have bad feeling about using admin client here. For the Angular client, this is a similar way, but not from the admin package.

Answer 1

Was this action started by an user? Usually you want to use the same token that came from your front-end and pass it along on your request, this way you can trace your request all the way back to who started it.

Using a token for your service means it can acess other services without being prompted by a human, maybe you want this, but typically you don't.

If you still want to get a token for your client you can use service accounts as described here:

https://github.com/keycloak/keycloak-documentation/blob/master/server_admin/topics/clients/oidc/service-accounts.adoc