Securing applications using keycloak

Question

I need some help in securing my applications with keycloak:

I have couple of grails applications (App1 and App2) using spring security. However, currently I am using keycloak REST API to authenticate users by passing username and password and receive token without registering these applications as clients in the keycloak. But this approach seems to be inefficient when we want to support SSO, social login, kerberos and other lot of powerful features that Keycloak offers. So I came up with the below approach to support SSO/kerberos but wanted to know if Keycloak can solve our problem.

"Create a new spring boot master application (App3) and register with Keycloak and redirect the login page to Keycloak. Once login is successful, use the token that keycloak provides and pass it on to App1 and App2 and tweak my existing code flow to handle this. Can this be possible because I am not creating any clients for app1 and app2 in keycloak here but only creating for app3 which is the master application? Is it mandatory to register/create all clients in Keycloak to support SSO?"

Answer 1

From what I understand, if you register this master app and use it to get tokens in order to authorize app1 and app2, it would make the access token useless. Since the client ID and secret belong to the master app, access token will be returning it as the audience in the token. If you validate the claims in the token when you are accessing a resource through app1 or app2, this would return an error as the intended audience is not met. If you ignore this fact, anyone with a token would be able to access whatever resource causing a security vulnerability.

Hope this helps.