Search code examples
javaspring-securitykeycloakpkce

Spring security client PKCE with Keycloak

I have a Java application using Spring Security 5.2.1 and secured by Keycloak.
The client in Keycloak is a public openid-connect client.
It works fine.

I have now a requirement to use PKCE (Proof Key for Code Exchange).
As Client Support for PKCE has been added to Spring Security 5.2.0.M2 and as I use Spring Security 5.2.1, I can use Spring Security to implement it.
That's the good news.
The 'bad' news is that I found nearly nothing on the Web or in the Spring Security documentation on how I must implement it, practically. Adding "enable-pkce": true in keycloak.json doesn't work, and I don't find any clear example of what to do.

Is there some documentation, website or whatever else, describing what to do to implementsthis ?

Thank you very much !

Solution

  • From the Spring Security reference documentation https://docs.spring.io/spring-security/site/docs/5.3.1.RELEASE/reference/html5/#initiating-the-authorization-request

    PKCE will automatically be used when the following conditions are true:

    1. client-secret is omitted (or empty)

    2. client-authentication-method is set to "none" (ClientAuthenticationMethod.NONE)