I see that in most of the keycloak tutorials it is suggested to create two client in keycloak i.e. frontend, backend. But I don't understand the need for this since I can validated the JWT token provided by frontend using public key even without creating separate client.

So my question is, is the approach of not creating the backend app the wrong approach? Also when & why should we create a backend client in keycloak.

Ref - https://medium.com/devops-dudes/secure-front-end-react-js-and-back-end-node-js-express-rest-api-with-keycloak-daf159f0a94e

CodePudding user response：

I see most of the tutorial of keycloak suggest to create two client in keycloak i.e. frontend, backend. But I don't understand the need of this as I can validated JWT token provided by frontend using public key even without creating separate client.

Typically, such tutorials are created to showcase the authentication and authorization capabilities of Keycloak.

The authentication part is showcased by the user authenticating via the browser (using the frontend client), whereas the authorization part is showcased by the application sending an access token to the Keycloak server where the claims on the access token (e.g., roles) can then be used to infer if the user has the permissions to perform the desire action (i.e., authorization).

So my question is, is approach of not creating backend app is not right approach?

Depends on your specific use case. Alternatively to the approach that I have previously mentioned, one could have had a single client (i.e, the frontend client), and after the user has successfully authenticated, the application would pass the access token to the backend. The backend could then perform the authorization by directly checking, for instance, the roles in the access token, instead of relying on the Keycloak server to do so. There are pros and cons to both approaches.

Also when & why should we create backend client in keycloak.

A typical example would be if the backend would be a separated micro-service that triggers some maintenance task for example. Assuming that task is not related at all to the user authentication process, it would make more sense to then have a separate client (in this case a confidential one) that would rely on the client credentials flow which is typically used for machine-to-machine use-cases.