So, I'm build an API System. I want to use KeyCloak for authentication as well as user management because it has a nice access control. I'm integrating it with Ktor and I want my user to use their own UI. Or at least, I want to make the UI.
I've read about Theme Customization but that's not what I want. I also come to know that the KeyCloak UI is tightly integrated within their code. I was just hoping to know if at least when one of the client app is a mobile app, would I be able to use for example android UI for the whole login flow?
If it's not possible which I think it's unlikely to be possible, is there any other library or framework for access control, prefereably one that work with Ktor?
If you do not want to use Keycloak UI nor create your own custom themes, you can leverage the Resource Owner Password Credentials Grant flow.
For this create a new or use an existing confidential client. Make sure to toggle the Direct Access Grants Enabled switch to ON.
After this obtain a token from your client (web page, CLI, mobile). Here I'm using curl and jq for simplicity:
KCHOST=https://yourkeycloak.com
REALM=your-realm
CLIENT_ID=your-confidential-client
CLIENT_SECRET=xxxxxxx-yyyyyyyy-zzzzzzzzz
ACCESS_TOKEN=`curl \
-d "client_id=$CLIENT_ID" -d "client_secret=$CLIENT_SECRET" \
-d "grant_type=client_credentials" \
"$KCHOST/auth/realms/$REALM/protocol/openid-connect/token" | jq -r '.access_token'`
P.S. For debugging I have created a CLI tool called brauzie that can help you fetch and analyse your JWT tokens (scopes, roles, etc.). It could be used for both public and confidential clients. You could as well use Postman and https://jwt.io
HTH :)