keycloak bearer-only clients: why do they exist?

Question

I am trying to wrap my head around the concept of bearer-only clients in Keycloak.

I understand the concept of public vs confidential and the concept of service accounts and the grant_type=client_credentials stuff. But with bearer-only, I'm stuck.

Googling only reveals fragments of discussions saying:

You cannot obtain a token from keycloak with a bearer-only client.

The docs are unclear as well. All they say is:

Bearer-only access type means that the application only allows bearer token requests.

Ok, if my app only allows bearer token requests, how do I obtain this token if I cannot get it from Keycloak using client id / client secret?

And if you can't obtain a token, what can you at all? Why do these clients exist? Can somebody please provide an example of using this type of client?

Answer 1

Bearer-only access type meaning

Bearer-only access type means that the application only allows bearer token requests. If this is turned on, this application cannot participate in browser logins.

So if you select your client as bearer-only then in that case keycloak adapter will not attempt to authenticate users, but only verify bearer tokens. That why keycloak documentation also mentioned bearer-only application will not allow the login from browser.

And if you can't obtain a token, what can you at all? Why do these clients exist?

Your client can't be set as bearer-only on Keycloak Server. You can still use bearer-only on the adapter configuration though. Keycloak doesn't allow "bearer only" clients (when setting up your client on the server) to obtain tokens from the server. Try to change your client to "confidential" on the server and set bearer-only on your adapter configuration (keycloak.json).

So if you understand above statement then if you have two microservice which are talking to each other in the case, caller will be confidential and callee will be bearer-only

And Keycloak also mentioned

Bearer only client are web service that never initiate a login .It’s typically used for securing the back-end.

So if you want to use any adapter you can use bearer-only depend on the need

EDIT-

Lets go in more details ..Let see one example i have a web-app and one rest-app for web-app i am using React/Angular/JSF any front end technology and for back-end i am using Java based rest-api OR Nodejs.

Now for above requirement i have to secure both the product(web-app,rest-api) so what will be my work of action? How i will secure both the app through Keycloak?

So here is details explanation

1. I have to create two client inside a realm in keycloak
2. Client A will be use by web-app
3. Client B will be used by rest-api
4. So now question will be why two client?
5. For web-app we want user should must login via GUI then only generate the token
6. For rest-api we dont want to GUI based api as these api consume by web-app but still rest-api we have to access securely.
7. Now Go to Client A and make its Access Type public client so web-app will ask to login via keycloak GUI or your login page then generate the token
8. So same token which generated in above step used by rest-api and according to user role and other information data will fetch. So Access Type of Client B will be bearer-only so web-app genrated token pass to rest-api and its used against authenticate user .

Hope it will help. Someone want to add more he/she free to add.