keycloak - Keycloak Bear-Only Client with and without Authorization Client Secret

Question

在 keycloak 中，当我将 a 设置Client为bearer-only访问类型且未经授权时，我得到以下配置以在我的服务器上安装

{
  "realm": "API",
  "bearer-only": true,
  "auth-server-url": "https://example.com.au/auth/1.0",
  "ssl-required": "none",
  "resource": "edge-server"
}

然后，当我为该客户端启用授权时，它现在包含客户端密码：

{
  "realm": "API",
  "bearer-only": true,
  "auth-server-url": "https://example.com.au/auth/1.0",
  "ssl-required": "none",
  "resource": "edge-server",
  "credentials": {
    "secret": "33333333-4444-5555-6666-777777777777"
  },
  "policy-enforcer": {}
}

所以我的问题是为什么我的服务器需要secret启用授权？

标签： keycloakbearer-token

Answer 1

Keycloak 授权策略只能应用于机密客户端，例如您的后端 REST API。