auth:keycloak-confidential-client

You can create a Keycloak confidential client by automating the registration of server-side applications using the OAuth2 client credentials grant flow. This ensures secure, programmatic access between backend services in a zero-trust environment without requiring user interaction.

A confidential client in Keycloak is an OAuth2 client designed for server-side applications to authenticate securely via the client credentials grant. You need it when deploying backend microservices that must programmatically access other services without direct user authentication.

Yes, Keycloak supports the client credentials grant flow by enabling service accounts for confidential clients. This allows Kubernetes-based microservices to securely authenticate with each other using configured security parameters instead of user credentials.

To enable service accounts for a Keycloak OAuth2 client, you must configure it as a confidential client and explicitly activate service account access. This configuration is required to successfully execute the client credentials grant flow for server-to-server authentication.

Automating microservice registration in Keycloak is best achieved by programmatically creating confidential OAuth2 clients with enabled service accounts. This approach provides the necessary credentials and security parameters for secure inter-service communication in a zero-trust environment.