v4.1.0 #65
v4.1.0 #65
Conversation
MBueschelberger
commented
Sep 22, 2025
MBueschelberger
commented
- Add service account login
- Refactor Re-authentication
- Update documentation
| | Client ID | If a service account is used to authenticate, this will proviode the Client ID in Keycloak | `Optional[SecretStr]`| `None` | `client_id` | Optional | `DSMS_CLIENT_ID`, `KEYCLOAK_DSMS_CLIENT_ID` or `KEYCLOAK_CLIENT_ID` | | ||
| | Client Secret | If a service account is used to authenticate, this will proviode the Client Secret in Keycloak | `Optional[SecretStr]`| `None` | `client_secret` | Optional | `DSMS_CLIENT_SECRET`, `KEYCLOAK_DSMS_CLIENT_SECRET` or `KEYCLOAK_CLIENT_SECRET` | |
There was a problem hiding this comment.
Can you explain why did you add these variables? To avoid using the DSMS admin user? Does it mean we need to share this client secret to all users?
There was a problem hiding this comment.
The DSMS Admin user is a hack which we identified to remove. It can also cause problems with the 2FA during internal processes in the backend. One instead can simply authenticate through the client secret with the serivce account, which is automatically enabled in Keycloak for each client.
I do not understand where you got the impression from that we are sharing the client secret with all users. The user has the ability to authenticate with ONE of the following options:
- username/password
- JWT
- client id/client secret
The latter one does not get exposed when using the first two one. The only place where we are using the third option is in the backend, where the client secret should also stay and not be exposed from.
There was a problem hiding this comment.
I don't understand:
- Where in the code we replaced the admin user with the confidential client
- Why do we need to add a new authentication method with client id/client secret
There was a problem hiding this comment.
We agreed on this three weeks ago!
See your message
There was a problem hiding this comment.
We did not replace anything in the backend, one authenticates with Keycloak directly.
* support reverse attribute in relation mapping * update name to inverse --------- Co-authored-by: Kiran Kumaraswamy <kiran.kumaraswamy@iwm.fraunhofer.de>
3 participants
