javascript - Angular Keycloak 登录(静默)

Question

有没有办法直接从 Angular/客户端应用程序使用“用户名”和“密码”登录？

例如像这样的东西？

Keycloak.init({username: 'guest', password: 'abc'});

Answer 1

官方 keycloak javascript adapter不支持 Resource Owner Password Credentials 流程。

可以使用默认流程(授权代码 流程)以外的流程来初始化适配器。

keycloak.init({ flow: 'implicit' })

flow - 设置 OpenID Connect 流。有效值为标准、隐式或混合。

请注意，不使用Resource Owner Password Credentials 流程是有正当理由的。

来自 key 斗篷 documentation

Resource Owner Password Credentials, referred to as Direct Grant in Keycloak, allows exchanging user credentials for tokens. It’s not recommended to use this flow unless you absolutely need to. Examples where this could be useful are legacy applications and command-line interfaces.

There are a number of limitations of using this flow, including:

• User credentials are exposed to the application

• Applications need login pages

• Application needs to be aware of the authentication scheme

• Changes to authentication flow requires changes to application

• No support for identity brokering or social login

• Flows are not supported (user self-registration, required actions, etc.)

其他资源:
Why the Resource Owner Password Credentials Grant Type is not Authentication nor Suitable for Modern Applications
How secure is the OAuth2 "Resource Owner Password Credential" flow for single-page apps?

如果您仍然想要/必须使用Resource Owner Password Credentials 流程，您应该可以自行实现。可以找到实现您自己的适配器所需的所有 keycloak 特定细节 here .