For the complete documentation index, see llms.txt. This page is also available as Markdown.

MS Entra ID managed identity for client credentials

Prerequisites

Permissions required for registering and configuring an app in Microsoft Entra ID.

The account must have permission to manage applications in Microsoft Entra ID. Ideally the account should be in the Global Admin role to grant admin consent.

Keycloak and Microsoft Entra ID configurations.

This article provides the minimum technical detail required to implement the solution. Detailed step-by-step guidance can be generated by an AI client from this content when needed.

Managed identity for Azure workloads

Fopr Azure workloads, Microsoft Entra User-Assigned Managed Identity (UAMI) can replace a long-lived Keycloak client secret or certificate.

Feature
Client secret
Certificate
Managed identity

Credential stored by workload

Yes

Private key

No

Rotation required

Yes

Yes

No application credential

Expiration management

Yes

Yes

No

Azure workload overhead

Medium

Medium

Low

Where managed identity is suitable, remove the application-managed credential and therefore remove its rotation process.

The steps below cover only the additional integration configuration.

Implement managed identity for client credentials

It is recommended to use two separate browser tabs for the Azure (A) and Keycloak (K) portals to make it easier to apply the settings.

  1. Configure the Entra appliance audience.

    1. (A) In the first tab, sign in to the Azure Portal.

    2. (A) Search for Microsoft Entra ID. Expand Manage in the left pane and click App registrations.

    3. (A) Navigate to the application created in MS Entra ID (OIDC).

    4. (A) Configure Application ID URI to api://{ENTRA-APPLICATION-CLIENT-ID} .

    5. (A) Configure the application manifest. This defines the audience requested by the managed identity and uses the Entra v2 token issuer expected by the Keycloak trust.

  2. Create and assign application role.

    1. (A) Navigate to the application created in MS Entra ID (OIDC).

    2. (A) Select Create app role.

    3. (A) Provide the following values then select Apply.

      Key
      Value

      Display name

      Keycloak Authenticate

      Allowed member types

      Applications

      Value

      Keycloak.Authenticate

      Enabled

      Yes

    4. (A) Assign this role to the UAMI with this PowerShell script. This explicitly authorizes the managed identify for the Keycloak authentication integration. The Entra token should contain roles = ["Keycloak.Authenticate"]. Managed Identity tokens are cached, so a new role assignment may not appear immediately.

  3. Enable Signed JWT - Federated in Keycloak. This makes the federated JWT authenticator available to Keycloak clients.

    1. (K) Open a new tab in your browser and login to the target Spark tenant. Access the Keycloak console from the User menu.

    2. (K) Navigate to Authentication and the Clients authentication flow.

    3. (K) Enable Signed JWT - Federated.

  4. Update the existing Entra OIDC identity provider.

    1. (A) Navigate to the application created in MS Entra ID (OIDC).

    2. (A) Update the following settings.

      Key
      Value

      Supports client assertions

      ON

      Allows client assertions to be re-used

      ON

      Allows Client ID as audience for assertions

      ON

    3. (A) Signature validation and the Entra JWKS URL must also be configured so Keycloak can validate Entra-signed assertions.

  5. Configure the Keycloak client.

    1. (K) Navigate to the client created in MS Entra ID (OIDC).

    2. (K) Under credentials configure:

      Key
      Value

      Client Authenticator

      Signed JWT - Federated

      Identity provider

      {ENTRA-IDP-ALIAS}

      Allows Client ID as audience for assertions

      {UAMI-OBJECT-ID}

    3. The federated subject maps the Entra managed identity to the Keycloak client.

      • UAMI Client ID used by Azure.Identity (ManagedIdentityClientId)

      • UAMI Object ID used for role assignment and Keycloak Federated subject.

  6. Obtain the Entra token.

    1. Use this C# code snippet to retrieve the Entra token.

    2. Verify the token contains the expected issuer (iss), audience (aud), managed identity subject (sub), and Keycloak.Authenticate role.

  7. Exchange the Entra token for a Keycloak token.

    1. Keycloak validates the Entra JWT as the client assertion and returns the normal Keycloak access token.

Last updated