MS Entra ID managed identity for client credentials

Prerequisites

Permissions required for registering and configuring an app in Microsoft Entra ID.

The account must have permission to manage applications in Microsoft Entra ID. Ideally the account should be in the Global Admin role to grant admin consent.

Keycloak and Microsoft Entra ID configurations.

• MS Entra ID (OIDC) implemented.

• Microsoft Entra User-Assigned Managed Identity (UAMI) implemented.

• In Keycloak, the administrator requires the following permissions: manage-identity-providers, view-identity-providers, view-authorization, manage-authorization, view-clients, and manage-clients.

This article provides the minimum technical detail required to implement the solution. Detailed step-by-step guidance can be generated by an AI client from this content when needed.

Managed identity for Azure workloads

Fopr Azure workloads, Microsoft Entra User-Assigned Managed Identity (UAMI) can replace a long-lived Keycloak client secret or certificate.

Feature	Client secret	Certificate	Managed identity
Credential stored by workload	Yes	Private key	No
Rotation required	Yes	Yes	No application credential
Expiration management	Yes	Yes	No
Azure workload overhead	Medium	Medium	Low

Where managed identity is suitable, remove the application-managed credential and therefore remove its rotation process.

The steps below cover only the additional integration configuration.

Implement managed identity for client credentials

It is recommended to use two separate browser tabs for the Azure (A) and Keycloak (K) portals to make it easier to apply the settings.

1. Configure the Entra appliance audience.

   1. (A) In the first tab, sign in to the Azure Portal.

   2. (A) Search for Microsoft Entra ID. Expand Manage in the left pane and click App registrations.

   3. (A) Navigate to the application created in MS Entra ID (OIDC).

   4. (A) Configure Application ID URI to api://{ENTRA-APPLICATION-CLIENT-ID} .

   5. (A) Configure the application manifest. This defines the audience requested by the managed identity and uses the Entra v2 token issuer expected by the Keycloak trust.

      "requestedAccessTokenVersion": 2 

2. Create and assign application role.

   1. (A) Navigate to the application created in MS Entra ID (OIDC).

   2. (A) Select Create app role.

   3. (A) Provide the following values then select Apply.

      Key	Value
      Display name	Keycloak Authenticate
      Allowed member types	Applications
      Value	Keycloak.Authenticate
      Enabled	Yes

   4. (A) Assign this role to the UAMI with this PowerShell script. This explicitly authorizes the managed identify for the Keycloak authentication integration. The Entra token should contain roles = ["Keycloak.Authenticate"]. Managed Identity tokens are cached, so a new role assignment may not appear immediately.

      Connect-MgGraph -Scopes "Application.Read.All","AppRoleAssignment.ReadWrite.All"
      $managedIdentityObjectId = "{UAMI-OBJECT-ID}"
      $resourceAppClientId = "{ENTRA-APPLICATION-CLIENT-ID}"
      $appRoleValue = "Keycloak.Authenticate"
      $resourceServicePrincipal = Get-MgServicePrincipal -Filter "appId eq '$resourceAppClientId'"
      $appRole = $resourceServicePrincipal.AppRoles | Where-Object { $_.Value -eq $appRoleValue -and $_.AllowedMemberTypes -contains "Application" -and $_.IsEnabled }
      $params = @{ PrincipalId = $managedIdentityObjectId; ResourceId = $resourceServicePrincipal.Id; AppRoleId = $appRole.Id }
      New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentityObjectId -BodyParameter $params

3. Enable Signed JWT - Federated in Keycloak. This makes the federated JWT authenticator available to Keycloak clients.

   1. (K) Open a new tab in your browser and login to the target Spark tenant. Access the Keycloak console from the User menu.

   2. (K) Navigate to Authentication and the Clients authentication flow.

   3. (K) Enable Signed JWT - Federated.

4. Update the existing Entra OIDC identity provider.

   1. (A) Navigate to the application created in MS Entra ID (OIDC).

   2. (A) Update the following settings.

      Key	Value
      Supports client assertions	ON
      Allows client assertions to be re-used	ON
      Allows Client ID as audience for assertions	ON

   3. (A) Signature validation and the Entra JWKS URL must also be configured so Keycloak can validate Entra-signed assertions.

5. Configure the Keycloak client.

   1. (K) Navigate to the client created in MS Entra ID (OIDC).

   2. (K) Under credentials configure:

      Key	Value
      Client Authenticator	Signed JWT - Federated
      Identity provider	{ENTRA-IDP-ALIAS}
      Allows Client ID as audience for assertions	{UAMI-OBJECT-ID}

   3. The federated subject maps the Entra managed identity to the Keycloak client.

      • UAMI Client ID used by Azure.Identity (ManagedIdentityClientId)

      • UAMI Object ID used for role assignment and Keycloak Federated subject.

6. Obtain the Entra token.

   1. Use this C# code snippet to retrieve the Entra token.

      using Azure.Core;
      using Azure.Identity;
      
      var credential = new DefaultAzureCredential(
          new DefaultAzureCredentialOptions
          {
              ManagedIdentityClientId = "<UAMI-CLIENT-ID>"
          });
      
      AccessToken token = await credential.GetTokenAsync(
          new TokenRequestContext(
          [
              "api://<ENTRA-APPLICATION-CLIENT-ID>/.default"
          ]));
      
      string entraAccessToken = token.Token;

   2. Verify the token contains the expected issuer (iss), audience (aud), managed identity subject (sub), and Keycloak.Authenticate role.

7. Exchange the Entra token for a Keycloak token.

   1. Keycloak validates the Entra JWT as the client assertion and returns the normal Keycloak access token.

      curl --location 'https://keycloak.{environment}.coherent.global/auth/realms/{tenant}/protocol/openid-connect/token' \
      --header 'Content-Type: application/x-www-form-urlencoded' \
      --data-urlencode 'grant_type=client_credentials' \
      --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' \
      --data-urlencode 'client_assertion={ENTRA-MANAGED-IDENTITY-TOKEN}'