oauth - 每个设备是否应该通过资源所有者密码凭据对 Keycloak 中的用户进行身份验证

Question

我正在 Keycloak 中使用人类用户和物联网设备实现身份验证系统。
人类用户:通过 spa 访问系统并使用基于标准重定向的身份验证流程。
物联网设备:该用例涉及许多非交互式的高值(value)设备，需要将遥测数据传输到后端并访问它们自己的数据以及来自相关用户的数据。我目前的计划是使用 Resource Owner Password Credentials Grant，因为可以在配置期间使用凭据设置嵌入式系统。
我的想法是，这将使我能够使用 Keycloak 组和角色进行权限管理和用户 <-> 设备关联。
这种方法有什么本质上的错误吗？

Answer 1

My current plan is to use the Resource Owner Password CredentialsGrant since the embedded system can be setup with credentials duringprovisioning.

来自 source可以阅读:

The resource owner password credentials grant type is suitable incases where the resource owner has a trust relationship with theclient, such as the device operating system or a highly privilegedapplication. The authorization server should take special care whenenabling this grant type and only allow it when other flows are notviable.

This grant type is suitable for clients capable of obtaining theresource owner’s credentials (username and password, typically usingan interactive form). It is also used to migrate existing clientsusing direct authentication schemes such as HTTP Basic or Digestauthentication to OAuth by converting the stored credentials to anaccess token:

您的用例是否满足这些限制？
如果不是，请考虑使用 Client Credentials Grant反而:

With machine-to-machine (M2M) applications, such as CLIs, daemons, orservices running on your back-end, the system authenticates andauthorizes the app rather than a user. For this scenario, typicalauthentication schemes like username + password or social logins don'tmake sense. Instead, M2M apps use the Client Credentials Flow (definedin OAuth 2.0 RFC 6749, section 4.4), in which they pass along theirClient ID and Client Secret to authenticate themselves and get atoken.

因此，在后者中，您将使用客户端 key 而不是使用用户名和密码进行身份验证。

My thinking is that this would enable me to use Keycloak Groups andRoles for permission management and User <-> Device Association.

您仍然可以向 secret 客户端添加声明并将其用于权限管理。