Adding clients to Keycloak for a system with one mobile app, one angular app, one api gateway and 4 other Micro services

Question

In my project, there is a mobile app, an angular web app, 4 micro services and one api gateway. The users with role 'agent' can enroll customers using the mobile app. The web app is for users with role 'manager' to see the customer data and finalize on the customer enrollment.

1. Here, if I want to set up Keycloak for authentication, should I add every micro service as a separate client ?
2. Should I add mobile app and web app as separate clients in keycloak ?

Answer 1

CLIENTS

The web and mobile app must be registered as separate OAuth clients. They will have a client ID but no client secret since they are public clients. They will use PKCE and have different redirect URIs, eg:

• Web: https://www.example.com/callback
• Mobile: com.example.app:/callback

APIs

By default APIs do not need to be registered as clients. In most setups related microservices can just forward JWT access tokens to each other, as explained in the scopes article. This is a secure way to maintain the user identity.

APIs sometimes act as clients though, eg if they need to do something like create users in Keycloak programmatically. Identity systems provide User Management Endpoints to enable this.

So one of your APIs, eg a Users Microservice, may need to be registered as a client. It would use the client credentials flow to get an access token with a SCIM related scope.

GATEWAY

It is common, and recommended, for a gateway to act as an introspection client. This enables data in access tokens returned to internet clients to be kept confidential. Read more about this in the phantom token pattern.