The open id configuration exposes some information like the following:

• Authorization endpoint
• Token endpoint
• Supported grant types
• Supported response types
• Supported response modes
• Supported claims
• Supported scopes

Use the following address syntax to find-out the OpenID configuration:

<KEYCLOAK_ADDRESS>/realms/<TARGET_REALM>/.well-known/openid-configuration

Example

Given

The OpenID configuration would be:

http://localhost:8080/realms/testrealm/.well-known/openid-configuration

Pre-requisite

• Keycloak 19^1

Creating a New Client and User

1. Sign in to keycloak admin console using the following address:

   Must know a valid credential.

   http://localhost:8080/admin/

2. Switch or create a realm that is NOT a master realm (i.e. leave the master realms for keycloak usage only), like the following (i.e. jwtrealm):
   

3. Create a new client as follows:

   1. Ensure that OpenID Connect is the Client type.

   2. Provide a Client ID (e.g. jwtclient).

   3. Click the Next button.

      

   4. Enable the Client authentication.

   5. In the Authentication flow, unselect the standard flow.

   6. Click the Save button.

      

4. Create a new user as follows:

   1. Fill-in the username field (e.g. testuser).

   2. Click the Create button.

      

   3. Click the Credentials tab.

   4. Click the Set password button.

   5. Fill-in the Password field.

   6. Fill-in the Password confirmation field.

   7. Turn-off temporary.

   8. Click the Save button.

      

   9. Click the Save password button.

Using Postman for Testing

1. Create a post request to the following address format:

   http://localhost:8080/realms/<TARGET_REALM>/protocol/openid-connect/token

   Example

   Using the jwtrealm as the TARGET_REALM (i.e. configured in the previous section).

   http://localhost:8080/realms/jwtrealm/protocol/openid-connect/token

2. Click the Body tab.

3. Select x-www-form-url-encoded.

4. Add the following entries:

   Key	Value	Comment
   client_id	jwtclient	This is the client configured earlier.
   grant_type	password	This is for direct access grant type.
   client_secret	<Client secret>	This can be found in the jwtclient (i.e. configured earlier) client credentials tab.
   scope	openid	The openid scope is required; to indicate that the application intends to use OIDC to verify the user's identity.
   username	testuser	This is the user configured earlier.
   password	<password>	This is the password for the user that is configured earlier.

5. Click the Send button.

   

Success Output

The success output is in the following format.

{
    "access_token": "The access token.",
    "expires_in": "Access token expiration.",
    "refresh_expires_in": "Refresh token expiration",
    "refresh_token": "The refresh token.",
    "token_type": "Bearer",
    "id_token": "The ID token.",
    "not-before-policy": 0,
    "session_state": "The session state.",
    "scope": "openid profile email"
}

You paste the encoded token to the following website to decode its content:

https://jwt.io/

Invalid Credential Output

{
    "error": "invalid_grant",
    "error_description": "Invalid user credentials"
}

Related Post
THE RESOURCE OWNER PASSWORD CREDENTIAL (ROPC) GRANT TYPE

Signing the CSR

1. Download OpenSSL binaries from the following link if you are using windows:

   https://slproweb.com/products/Win32OpenSSL.html

2. Create a v3.cnf file using the following template:

   authorityKeyIdentifier=keyid,issuer
   basicConstraints=CA:FALSE
   keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   subjectAltName          = @alternate_names
   nsComment           = "Self-signed Certificate"
   
   [ alternate_names ]
   
   DNS.1       = <DNS_1>
   #DNS.2       = <DNS_2>
   #DNS.3       = <DNS_3>
   #DNS.4       = <DNS_4>
   
   # Add these if you need them. But usually you don't want them or
   #   need them in production. You may need them for development.
   # DNS.5       = localhost
   # DNS.6       = localhost.localdomain
   # DNS.7       = 127.0.0.1
   
   # IPv6 localhost
   # DNS.8     = ::1

   Replace the following fields on the template:

   Field Name	Description
   DNS_<INDEX>	Identify the DNS names from the CSR.

   Example:

   authorityKeyIdentifier=keyid,issuer
   basicConstraints=CA:FALSE
   keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   subjectAltName          = @alternate_names
   nsComment           = "Self-signed Certificate"
   
   [ alternate_names ]
   
   DNS.1       = www.ronella.xyz
   #DNS.2       = <DNS_2> 
   #DNS.3       = <DNS_3>
   #DNS.4       = <DNS_4>
   
   # Add these if you need them. But usually you don't want them or
   #   need them in production. You may need them for development.
   # DNS.5       = localhost
   # DNS.6       = localhost.localdomain
   # DNS.7       = 127.0.0.1
   
   # IPv6 localhost
   # DNS.8     = ::1

3. Generate a CA private key and certificate pair. The following link can help:
   PRIVATE CERTIFICATION AUTHORITY (CA)

4. Once you have the pair (i.e. key is ca.key.pem and the certificate is ca.cert.crt), sign the CSR using the following command:

   openssl x509 -req -days 365 -sha256 -in domain.csr -extfile v3.cnf -CA ca.cert.crt -CAkey ca.key.pem -CAcreateserial -out domain.crt

Viewing the generated certificate from CSR

1. View the signed certificate using the following the command:

   openssl x509 -in domain.crt -text

Generating a CSR

1. Download OpenSSL binaries from the following link if you are using windows:

   https://slproweb.com/products/Win32OpenSSL.html

2. Create a domain.cnf file using the following template:

   [ req ]
   default_bits        = 2048
   default_keyfile     = private.pem
   distinguished_name  = subject
   req_extensions      = req_ext
   x509_extensions     = x509_ext
   string_mask         = utf8only
   
   [ subject ]
   countryName         = Country Name (2 letter code)
   countryName_default     = <2_LETTER_COUNTRY_CODE>
   
   stateOrProvinceName     = State or Province Name (full name)
   stateOrProvinceName_default = <STATE_NAME>
   
   localityName            = Locality Name (eg, city)
   localityName_default        = <CITY_NAME>
   
   organizationName         = Organization Name (eg, company)
   organizationName_default    = <ORGANIZATION_NAME>
   
   organizationalUnitName         = Organizational Unit (eg, section)
   organizationalUnitName_default = <ORGANIZATIONAL_UNIT>
   
   commonName          = Common Name (e.g. server FQDN or YOUR name)
   commonName_default      = <YOUR_NAME>
   
   emailAddress            = Email Address
   emailAddress_default        = <YOUR_EMAIL_ADDR>
   
   # Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
   [ x509_ext ]
   
   subjectKeyIdentifier        = hash
   authorityKeyIdentifier    = keyid,issuer
   
   basicConstraints        = CA:false
   keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   subjectAltName          = @alternate_names
   nsComment           = "Self-signed Certificate"
   
   # Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
   [ req_ext ]
   
   subjectKeyIdentifier        = hash
   
   basicConstraints        = CA:false
   keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   subjectAltName          = @alternate_names
   nsComment           = "Private Certificate"
   
   [ alternate_names ]
   
   DNS.1        = <DNS_1>
   
   # Add more DNS by incrementing the DNS.<SUFFIX> like the following.
   # DNS.2       = <DNS_2>
   # DNS.3       = <DNS_3>
   # DNS.4       = <DNS_4>
   
   # Add these if you need them. But usually you don't want them or
   #   need them in production. You may need them for development.
   # DNS.5       = localhost
   # DNS.6       = localhost.localdomain
   # DNS.7       = 127.0.0.1
   
   # IPv6 localhost
   # DNS.8     = ::1

   Replace the following fields on the template:

   Field Name	Description
   2_LETTER_COUNTRY_CODE	The two letter code of your country.
   STATE_NAME	The name of your state.
   CITY_NAME	The name of your city.
   ORGANIZATION_NAME	The name of your organization.
   ORGANIZATIONAL_UNIT	The name of your section in the organization.
   YOUR_NAME	Your full name.
   YOUR_EMAIL_ADDR	Your email address.
   DNS_<INDEX>	Your DNS name.

   Example:

   [ req ]
   default_bits        = 2048
   default_keyfile     = private.pem
   distinguished_name  = subject
   req_extensions      = req_ext
   x509_extensions     = x509_ext
   string_mask         = utf8only
   
   [ subject ]
   countryName         = Country Name (2 letter code)
   countryName_default     = NZ
   
   stateOrProvinceName     = State or Province Name (full name)
   stateOrProvinceName_default = Wellington
   
   localityName            = Locality Name (eg, city)
   localityName_default        = Wellington
   
   organizationName         = Organization Name (eg, company)
   organizationName_default    = My Organization
   
   organizationalUnitName         = Organizational Unit (eg, section)
   organizationalUnitName_default = IT Department
   
   commonName          = Common Name (e.g. server FQDN or YOUR name)
   commonName_default      = www.ronella.xyz
   
   emailAddress            = Email Address
   emailAddress_default        = ron@ronella.xyz
   
   # Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
   [ x509_ext ]
   
   subjectKeyIdentifier        = hash
   authorityKeyIdentifier    = keyid,issuer
   
   basicConstraints        = CA:false
   keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   subjectAltName          = @alternate_names
   nsComment           = "Self-signed Certificate"
   
   # Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
   [ req_ext ]
   
   subjectKeyIdentifier        = hash
   
   basicConstraints        = CA:false
   keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   subjectAltName          = @alternate_names
   nsComment           = "Private Certificate"
   
   [ alternate_names ]
   
   DNS.1        = www.ronella.xyz
   
   # Add more DNS by incrementing the DNS.<SUFFIX> like the following.
   # DNS.2       = <DNS_2>
   # DNS.3       = <DNS_3>
   # DNS.4       = <DNS_4>
   
   # Add these if you need them. But usually you don't want them or
   #   need them in production. You may need them for development.
   # DNS.5       = localhost
   # DNS.6       = localhost.localdomain
   # DNS.7       = 127.0.0.1
   
   # IPv6 localhost
   # DNS.8     = ::1

3. Generate a private key using the following command:

   openssl genrsa -out domain.key.pem 2048

4. Generate the CSR using the private key with the following command:

   openssl req -new -key domain.key.pem -nodes -out domain.csr -config domain.cnf

Viewing the Generated CSR

1. View the generated CSR using the following command:

   openssl req -text -noout -verify -in domain.csr

Create the private key and certificate pair.

1. Download OpenSSL binaries from the following link if you are using windows:

   https://slproweb.com/products/Win32OpenSSL.html

2. Create a ca.cnf file using the following template:

   [ req ]
   default_bits        = 2048
   default_keyfile     = private.pem
   distinguished_name  = subject
   req_extensions      = req_ext
   x509_extensions     = x509_ext
   string_mask         = utf8only
   
   # The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description).
   #   Its sort of a mashup. For example, RFC 4514 does not provide emailAddress.
   [ subject ]
   countryName         = Country Name (2 letter code)
   countryName_default     = <2_LETTER_COUNTRY_CODE>
   
   stateOrProvinceName     = State or Province Name (full name)
   stateOrProvinceName_default = <STATE_NAME>
   
   localityName            = Locality Name (eg, city)
   localityName_default        = <CITY_NAME>
   
   organizationName         = Organization Name (eg, company)
   organizationName_default    = <ORGANIZATION_NAME>
   
   organizationalUnitName         = Organizational Unit (eg, section)
   organizationalUnitName_default = <ORGANIZATIONAL_UNIT>
   
   # Use a friendly name here because it's presented to the user. The server's DNS
   #   names are placed in Subject Alternate Names. Plus, DNS names here is deprecated
   #   by both IETF and CA/Browser Forums. If you place a DNS name here, then you
   #   must include the DNS name in the SAN too (otherwise, Chrome and others that
   #   strictly follow the CA/Browser Baseline Requirements will fail).
   commonName          = Common Name (e.g. server FQDN or YOUR name)
   commonName_default      = <YOUR_NAME>
   
   emailAddress            = Email Address
   emailAddress_default        = <YOUR_EMAIL_ADDR>
   
   # Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
   [ x509_ext ]
   
   subjectKeyIdentifier        = hash
   authorityKeyIdentifier    = keyid,issuer
   
   basicConstraints        = CA:TRUE
   keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, cRLSign
   nsComment           = "Private CA"
   
   # Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
   [ req_ext ]
   
   subjectKeyIdentifier        = hash
   
   basicConstraints        = CA:true
   keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, cRLSign
   nsComment           = "Private CA"

   Replace the following fields on the template:

   Field Name	Description
   2_LETTER_COUNTRY_CODE	The two letter code of your country.
   STATE_NAME	The name of your state.
   CITY_NAME	The name of your city.
   ORGANIZATION_NAME	The name of your organization.
   ORGANIZATIONAL_UNIT	The name of your section in the organization.
   YOUR_NAME	Your full name or anything that represents you as a CA.
   YOUR_EMAIL_ADDR	Your email address.

   Example:

   [ req ]
   default_bits        = 2048
   default_keyfile     = private.pem
   distinguished_name  = subject
   req_extensions      = req_ext
   x509_extensions     = x509_ext
   string_mask         = utf8only
   
   # The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description).
   #   Its sort of a mashup. For example, RFC 4514 does not provide emailAddress.
   [ subject ]
   countryName         = Country Name (2 letter code)
   countryName_default     = NZ
   
   stateOrProvinceName     = State or Province Name (full name)
   stateOrProvinceName_default = Wellington
   
   localityName            = Locality Name (eg, city)
   localityName_default        = Wellington
   
   organizationName         = Organization Name (eg, company)
   organizationName_default    = My Company
   
   organizationalUnitName         = Organizational Unit (eg, section)
   organizationalUnitName_default = IT Department
   
   # Use a friendly name here because it's presented to the user. The server's DNS
   #   names are placed in Subject Alternate Names. Plus, DNS names here is deprecated
   #   by both IETF and CA/Browser Forums. If you place a DNS name here, then you
   #   must include the DNS name in the SAN too (otherwise, Chrome and others that
   #   strictly follow the CA/Browser Baseline Requirements will fail).
   commonName          = Common Name (e.g. server FQDN or YOUR name)
   commonName_default      = Ronaldo Webb CA APR 2021
   
   emailAddress            = Email Address
   emailAddress_default        = ron@ronella.xyz
   
   # Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...
   [ x509_ext ]
   
   subjectKeyIdentifier        = hash
   authorityKeyIdentifier    = keyid,issuer
   
   basicConstraints        = CA:TRUE
   keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, cRLSign
   nsComment           = "Private CA"
   
   # Section req_ext is used when generating a certificate signing request. I.e., openssl req ...
   [ req_ext ]
   
   subjectKeyIdentifier        = hash
   
   basicConstraints        = CA:true
   keyUsage            = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, cRLSign
   nsComment           = "Private CA"

3. Generate a private key using the following command:

   openssl genrsa -out ca.key.pem 2048

4. Generate a certificate with a validity of 10 years from the private key using the following command:

   openssl req -x509 -sha256 -new -nodes -key ca.key.pem -days 3650 -out ca.cert.crt -config ca.cnf

Viewing the generated certificate

1. View the generated certificate using the following command:

   openssl x509 -in ca.cert.crt -text