Search code examples
node.jskeycloakkeycloak-rest-api

Make user registration requests from my frontend in Keycloak using its API directly

In my Angular application (Frontend) the users can sign-in as following:

  • The user will fill-up a login-form (username or email / password).
  • The user will click on Login and that will hit this endpoint: http://localhost:8080/auth/realms/REALM_NAME/protocol/openid-connect/token
  • The user will have an answer in JWT format and will get his access_token (jwt token), refresh_token... etc.
  • Now this token will be used to access my backend APIs that will check the validity of the signature of this token against the JWKs_URI (with the encryption RSA256).

The question now is : how can I enable user registration in the same way, which means, I wish that the user can:

  • Fill up a registration form
  • Enter his email, password, password confirmation, more info (attributes maybe)
  • The user will then click on Register and it will hit an endpoint in Keycloak (/register maybe) which will return some answer about the success of this registration.

BTW: I don't want to use the user management API.

Solution

  • You can use Keycloak Admin REST API to register new users. Make sure to not expose it carelessly.

    Regarding you question, related to the authentication, you can register a Keycloak OIDC client. OIDC offers a bunch of resources you can use.

    If you register your application as a Keycloak client that uses OIDC direct grant. Basically "direct grant" implies you can get an access token with just a simple POST to /realms/{realm-name}/protocol/openid-connect/token.

    The documentation about direct grants is scattered across the Keycloak documentation and some details can only be found in the OIDC RFCs; so I found you this page that ties everything together.

    Careful again ! It might be obvious but don't turn you Angular app into a OIDC client otherwise hacker will steal your Keycloak client's credentials. Make sure to have your Angular app call some server, where you'll implement the necessary safety mechanism to block abusive use of your client (for instance using CAPTCHA).