Skip to content

Clients

A client is an application allowed to ask your domain to authenticate someone. Registering it is what turns "sign in with our accounts" from an idea into a working button.

For the same steps in the console, see the console walkthrough.

Public or confidential

One setting decides everything else: whether the application can keep a secret.

Public Confidential
Runs In the user's browser or on their device On a server you control
Examples Single-page app, mobile app Web application, backend service
Secret None - its code can be read Issued, and kept out of source control
spec.public true false

Register the client as public if you are not sure. A server-side application registered as public is weaker than it should be, but it works; a browser application registered as confidential does not work at all, because the secret it needs cannot be kept.

Create

client.yaml
apiVersion: v1.edp.epam.com/v1
kind: KeycloakClient
metadata:
  name: <client-id>
  namespace: <project>
spec:
  clientId: <client-id>
  public: true
  standardFlowEnabled: true
  realmRef:
    name: <domain-object-name>
  redirectUris:
    - https://<app-host>/callback
  webOrigins:
    - https://<app-host>

oc apply -f client.yaml

realmRef takes the object name, not the domain

realmRef.name is the metadata.name of the KeycloakRealm - the one with hyphens instead of dots, such as example-com.

clientId is the identifier your application sends, so it has to match what the application is configured with, exactly. It cannot be changed afterwards.

Leave standardFlowEnabled: true. That is the authorization code flow, which is what both kinds of application should use.

Redirect URIs are a security control

After signing someone in, the domain returns them only to a URL matching this list. That is what stops an attacker redirecting a successful sign-in to a site of their own.

List the exact URLs your application uses. Avoid a trailing wildcard unless you genuinely need one - a pattern matching more than you intended is exactly the hole this list exists to close.

webOrigins is separate and only matters for browser applications: it is what allows the browser to make the request at all.

List

oc get keycloakclients.v1.edp.epam.com -n <project>

oc get keycloakclients.v1.edp.epam.com <name> -n <project> \
  -o jsonpath='{.status.value}{"\n"}'

Get the secret

For a confidential client, the operator generates a secret and stores it in the project as keycloak-client-<metadata.name>-secret:

oc get secret keycloak-client-<name>-secret -n <project> \
  -o jsonpath='{.data.clientSecret}' | base64 -d

Read it into your application's configuration. Do not commit it.

Your application's OIDC discovery URL is https://<keycloak-host>/realms/<your-domain>/.well-known/openid-configuration.

Change

Redirect URIs and web origins can be changed in place, and this is the field you will come back to whenever the application moves or gains an environment:

oc patch keycloakclients.v1.edp.epam.com <name> -n <project> --type=merge -p '
spec:
  redirectUris:
    - https://<app-host>/callback
    - https://<other-host>/callback
'

The list replaces rather than adds - include the URLs already there.

clientId, the realm, and whether the client is public are all fixed once created. Moving an application from public to confidential means registering a new client.

Delete

oc delete keycloakclients.v1.edp.epam.com <name> -n <project>

The application stops being able to authenticate anyone immediately. Users are unaffected - they keep their accounts and their groups, and can still sign in to your other applications.