Client credentials grant (OAuth 2.0)

Client credentials

The client credentials grant feature of OAuth 2.0 enables server-to-server authentication, without involving actual users. It provides a special ID for the server, allowing it to assign permissions as if it were a real user. For more details, see IETF RFC 6749.

The client credentials grant is particularly useful in Spark systems when performing API operations that don't involve any user interaction. This can include CI/CD operations or any other tasks that require communication with OAuth 2.0 protected APIs.

Create client

1. Sign in to the target Spark tenant. Access the Keycloak console from the User menu.

2. On the left pane select Clients.

3. In the Clients list tab, select Create client.

4. Fill in the required details and select Next.

   Key	Value
   Client ID	Your Client ID name
   Client type	openid-connect

5. Apply the following settings and select Next. Service account roles should be checked automatically and grayed out.

   Key	Value
   Standard flow enabled	Off
   Direct access grants	Off
   Client authentication	On
   Authorization	On

6. Leave Login Settings unfilled and select Save.

Create client mappers

1. Select the Client scopes tab.

2. In the Assigned client scope column, select {clientname}-dedicated, for example ccdemo-dedicated.

3. Select Add mapper, then select By configuration from the dropdown list.

4. Select Audience and enter the following:

   Key	Value
   Name	aud
   Included Client Audience	product-factory
   Add to access token	On

5. Select Save.

6. Select Add mapper and select By configuration from the dropdown list.

7. Select Hardcoded claim and enter the following:

   Key	Value
   Name	realm
   Token Claim Name	realm
   Claim value	<mytenant>
   Claim JSON Type	String
   Add to access token	On

8. Select Save.

9. Select Add mapper and select By configuration from the dropdown list.

10. Select Group Membership and enter the following:

    Key	Value
    Name	groups
    Token Claim Name	groups
    Add to access token	On
    Full Group Path	Off

11. Select Save.

Add client credentials to groups

1. Go to the Service Account Roles tab.

2. Just below the tab, select the link labeled: To manage detail and group mappings, click on the username {your service account name}.

3. On the User Details page, select the Groups tab.

4. Select Join Group, select the desired group (for example supervisor:pf) and select Join.

Create the credential

1. On the left panel, select Clients under Manage.

2. Select your newly created client.

3. Select the Credentials tab at the top.

4. Copy the Client secret using the clipboard icon. Securely store this value.

5. Copy the Client ID from the top left corner of the page. Securely store this value.

6. Run this curl statement:

   curl --location 'https://keycloak.{environment}.coherent.global/auth/realms/{tenant}/protocol/openid-connect/token' \
   --header 'Content-Type: application/x-www-form-urlencoded' \
   --data-urlencode 'grant_type=client_credentials' \
   --data-urlencode 'client_id={client_id}' \
   --data-urlencode 'client_secret={client_secret}'

7. Replace the {environment}, {tenant}, {client_id}, {client_secret} with the appropriate values.

8. Submit the request.

9. From the response, retrieve the value of the access_token key.

10. Assign the client credential the appropriate permissions to folders in Set permissions.

11. Create a GET API request:

    1. URI: https://excel.{environment}/api/v1/lookup/getcategories.

    2. Header: Authorization: Bearer {token}.

12. Send the API request.

13. You should receive a 200 OK response.