___HTMLTAG_893__HTMLTAG_894___替換： 對所有客戶端（包括 SPA）使用授權代碼流 + PKCE。

如果被迫支援舊系統：

# Bật Implicit Flow trong client settings
Capability Config → Implicit flow: ON
Request (trả về token trực tiếp)
GET /realms/my-company/protocol/openid-connect/auth?
response_type=id_token token&
client_id=legacy-app&
redirect_uri=http://localhost:3000/callback&
scope=openid profile&
state=random-state&
nonce=random-nonce

HTMLTAG_899__HTMLTAG_900___5.4 用戶端憑證流程___HTMLTAG_901__HTMLTAG_902

用於 機器對機器身份驗證 — 無使用者互動。客戶端使用自己的憑證進行自身身份驗證。

___HTMLTAG_907__HTMLTAG_908___用例：HTMLTAG_909__HTMLTAG_910

___HTMLTAG_912__HTMLTAG_913___微服務呼叫微服務___HTMLTAG_914__HTMLTAG_915___ ___HTMLTAG_916__HTMLTAG_917___後端批次作業___HTMLTAG_918__HTMLTAG_919___ ___HTMLTAG_920__HTMLTAG_921___排程任務需要 API 存取權限___HTMLTAG_922__HTMLTAG_923___ ___HTMLTAG_924__HTMLTAG_925___CI/CD 管道___HTMLTAG_926__HTMLTAG_927___

___HTMLTAG_929__HTMLTAG_930___設定：HTMLTAG_931__HTMLTAG_932

___HTMLTAG_934__HTMLTAG_935___建立 機密客戶端（客戶端驗證 = ON）___HTMLTAG_940__HTMLTAG_941___1 ___HTMLTAG_942__HTMLTAG_943___在功能設定中啟用 服務帳號角色___HTMLTAG_946__HTMLTAG_947___ ___HTMLTAG_948__HTMLTAG_949___將角色指派給服務帳戶：客戶端→ 服務帳戶角色選項卡___HTMLTAG_952__HTMLTAG_953___

# Request token
POST /realms/my-company/protocol/openid-connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=my-service&
client_secret=MY_CLIENT_SECRET&
scope=openid

# Response
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "expires_in": 300,
  "token_type": "Bearer",
  "not-before-policy": 0,
  "scope": "openid profile email"
}
# Lưu ý: KHÔNG có refresh_token và id_token trong Client Credentials flow

___HTMLTAG_955__HTMLTAG_956___5.5 設備授權 (RFC 8628)HTMLTAG_957__HTMLTAG_958

適用於有輸入限制的設備 — 智慧電視、物聯網設備、CLI 工具。使用者使用代碼在另一台裝置（手機、筆記型電腦）上進行身份驗證。

___HTMLTAG_966__HTMLTAG_967___客戶端 → 功能設定 → 啟用 OAuth 2.0 設備授權___HTMLTAG_969__HTMLTAG_970__HTMLTAG_971___ ___HTMLTAG_972__HTMLTAG_973___領域設定 → 設定 OAuth 設備代碼 生命週期（預設 600 秒）___HTMLTAG_976__HTMLTAG_977______

# Bước 1: Device request — lấy device code và user code
POST /realms/my-company/protocol/openid-connect/auth/device
Content-Type: application/x-www-form-urlencoded

client_id=my-tv-app

# Response
{
  "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
  "user_code": "WDJB-MJHT",
  "verification_uri": "http://localhost:8080/realms/my-company/device",
  "verification_uri_complete": "http://localhost:8080/realms/my-company/device?user_code=WDJB-MJHT",
  "expires_in": 600,
  "interval": 5
}

# Bước 2: Hiển thị user_code và verification_uri trên TV/device
# User truy cập verification_uri trên phone/laptop, nhập user_code, đăng nhập

# Bước 3: Device polling — kiểm tra xem user đã xác thực chưa
POST /realms/my-company/protocol/openid-connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:device_code&
client_id=my-tv-app&
device_code=GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS

# Response khi user chưa xác thực
{
  "error": "authorization_pending",
  "error_description": "The authorization request is still pending"
}

# Response khi user đã xác thực — nhận tokens
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "eyJhbGciOi...",
  "id_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 300
}

___HTMLTAG_992__HTMLTAG_993__HTMLTAG_994___銀行：銷售點透過行動應用驗證付款____HTMLTAG_996__HTMLTAG_997___ ___HTMLTAG_998__HTMLTAG_999__HTMLTAG_1000___電信：基於 SIM 卡的驗證___HTMLTAG_1002__HTMLTAG_1003___ ___HTMLTAG_1004__HTMLTAG_1005__HTMLTAG_1006___呼叫中心：代理透過電話驗證客戶____HTMLTAG_1008__HTMLTAG_1009___

___HTMLTAG_1011__HTMLTAG_1012___CIBA 設定：HTMLTAG_1013__HTMLTAG_1014

___HTMLTAG_1016__HTMLTAG_1017___客戶端 → 功能設定 → 啟用 OIDC CIBA 資助___HTMLTAG_1019__HTMLTAG_1020__HTMLTAG_1021___ ___HTMLTAG_1022__HTMLTAG_1023___領域設定 → 驗證 → 選項卡 CIBA 政策:___HTMLTAG_1026__HTMLTAG:___HTMLTAG_1026__HTMLTAG_1027___

# CIBA authentication request
POST /realms/my-company/protocol/openid-connect/ext/ciba/auth
Content-Type: application/x-www-form-urlencoded

client_id=my-pos-app&
client_secret=CLIENT_SECRET&
scope=openid&
[email protected]&
binding_message=Xac+nhan+thanh+toan+500k

# Response
{
  "auth_req_id": "eyJhbGciOiJSUzI1NiIs...",
  "expires_in": 120,
  "interval": 5
}

# Polling for token (giống Device Auth)
POST /realms/my-company/protocol/openid-connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:openid:params:grant-type:ciba&
client_id=my-pos-app&
client_secret=CLIENT_SECRET&
auth_req_id=eyJhbGciOiJSUzI1NiIs...

___HTMLTAG_1075__HTMLTAG_1076___自訂 CIBA 驗證頻道提供者：HTMLTAG_1077__HTMLTAG_1078

預設 Keycloak 在內部使用 CIBALoginUserResolver。若要傳送實際的推播通知，您需要實作 SPI 自訂：

// Implement interface CIBAAuthenticationChannelProvider
public class MyCIBAChannelProvider implements CIBAAuthenticationChannelProvider {
@Override
public void requestAuthentication(
    CIBALoginUserResolver.CIBALoginUser user,
    AuthenticationChannelRequest request) {
    // Gửi push notification đến user's device
    // binding_message: "Xác nhận thanh toán 500k"
    pushNotificationService.send(
        user.getDeviceToken(),
        request.getBindingMessage(),
        request.getAuthResultUrl()
    );
}

@Override
public boolean verifyAuthentication(String authResultId) {
    // Verify kết quả từ user's device
    return authResultStore.isApproved(authResultId);
}

}

___HTMLTAG_1083__HTMLTAG_1084___6。將 OIDC 用戶端與 React 整合 (SPA)HTMLTAG_1085__HTMLTAG_1086______HTMLTAG_1087__HTMLTAG_1088___6.1 使用 keycloak-js 適配器___HTMLTAG_1089__HTMLTAG_1090

Keycloak 為 SPA 提供官方 JavaScript 適配器：

# Cài đặt
npm install keycloak-js

___HTMLTAG_1093__HTMLTAG_1094___為 React 設定 Keycloak 用戶端：HTMLTAG_1095__HTMLTAG_1096

Client ID: my-react-app
Client authentication: OFF (public client)
Valid redirect URIs: http://localhost:3000/*
Valid post logout redirect URIs: http://localhost:3000/*
Web origins: http://localhost:3000
PKCE Code Challenge Method: S256

___HTMLTAG_1097__HTMLTAG_1098___在React中初始化Keycloak：HTMLTAG_1099__HTMLTAG_1100

// src/keycloak.ts
import Keycloak from "keycloak-js";

const keycloak = new Keycloak({
  url: "http://localhost:8080",
  realm: "my-company",
  clientId: "my-react-app",
});

export default keycloak;

預編碼_20

// src/App.tsx
import Keycloak from "keycloak-js";

interface AppProps {
  keycloak: Keycloak;
}

function App({ keycloak }: AppProps) {
  const handleLogout = () => {
    keycloak.logout({
      redirectUri: window.location.origin,
    });
  };

  const callApi = async () => {
    // Tự động gắn Bearer token vào API calls
    const response = await fetch("http://localhost:8081/api/data", {
      headers: {
        Authorization: `Bearer ${keycloak.token}`,
      },
    });
    const data = await response.json();
    console.log(data);
  };

  return (
    <div>
      <h1>Welcome, {keycloak.tokenParsed?.preferred_username}</h1>
      <p>Email: {keycloak.tokenParsed?.email}</p>
      <p>Roles: {keycloak.tokenParsed?.realm_access?.roles?.join(", ")}</p>
      <button onClick={callApi}>Call API</button>
      <button onClick={handleLogout}>Logout</button>
    </div>
  );
}

export default App;

___HTMLTAG_1101__HTMLTAG_1102___6.2 使用react-oidc-context（取代keycloak-js）HTMLTAG_1103__HTMLTAG_1104

另一個選項是使用基於 oidc-client-ts 的函式庫 react-oidc-context — 它不依賴特定於 10101370707372_U +107___m

npm install react-oidc-context oidc-client-ts

// src/main.tsx
import { AuthProvider } from "react-oidc-context";

const oidcConfig = {
  authority: "http://localhost:8080/realms/my-company",
  client_id: "my-react-app",
  redirect_uri: "http://localhost:3000/callback",
  post_logout_redirect_uri: "http://localhost:3000",
  scope: "openid profile email",
  automaticSilentRenew: true,
};

ReactDOM.createRoot(document.getElementById("root")!).render(
  <AuthProvider {...oidcConfig}>
    <App />
  </AuthProvider>
);

預編碼_24

HTMLTAG_1111__HTMLTAG_1112___7。將 OIDC 用戶端與 Spring Boot 整合___HTMLTAG_1113__HTMLTAG_1114

HTMLTAG_1115__HTMLTAG_1116___7.1 Spring Boot OAuth2 資源伺服器___HTMLTAG_1117__HTMLTAG_1118

將 Spring Boot 設定為 資源伺服器 — 驗證來自 Keycloak 的 JWT 令牌：

預編碼_25

# application.yml
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://localhost:8080/realms/my-company
          jwk-set-uri: http://localhost:8080/realms/my-company/protocol/openid-connect/certs

預編碼_27

___HTMLTAG_1123__HTMLTAG_1124___7.2 Spring Boot OAuth2 用戶端（伺服器端登入）HTMLTAG_1125__HTMLTAG_1126

將 Spring Boot 設定為 OAuth2 用戶端 — 伺服器端登入流程：

預編碼_28

預編碼_29

___HTMLTAG_1131__HTMLTAG_1132___Spring Boot OAuth2 用戶端的 Keycloak 用戶端設定：HTMLTAG_1133__HTMLTAG_1134

Client ID: my-backend-app
Client authentication: ON (confidential)
Valid redirect URIs: http://localhost:8081/login/oauth2/code/keycloak
Backchannel logout URL: http://localhost:8081/logout/connect/back-channel/keycloak
Web origins: http://localhost:8081

HTMLTAG_1135__HTMLTAG_1136___8。進階客戶端設定___HTMLTAG_1137__HTMLTAG_1138

HTMLTAG_1139__HTMLTAG_1140___8.1 進階選項卡___HTMLTAG_1141__HTMLTAG_1142

客戶端的 進階 標籤中的進階設定：

___HTMLTAG_1225__HTMLTAG_1226___8.2 憑證標籤（機密客戶端）HTMLTAG_1227__HTMLTAG_1228

管理客戶端憑證：

___HTMLTAG_1232__HTMLTAG_1233__HTMLTAG_1234___客戶端驗證器：客戶端 ID 與金鑰（預設）、簽章 JWT (client_secret_jwt)、帶私鑰電話 JWT (private_ ___HTMLTAG_1238__HTMLTAG_1239__HTMLTAG_1240___客戶端金鑰：如果外洩則重新產生___HTMLTAG_1242__HTMLTAG_1243___ ___HTMLTAG_1244__HTMLTAG_1245__HTMLTAG_1246___註冊存取權杖：用於動態用戶端註冊___HTMLTAG_1248__HTMLTAG_1249___

將角色指派給服務帳戶（客戶端憑證流程）：

___HTMLTAG_1258__HTMLTAG_1259___開啟客戶端 → 標籤 服務帳戶角色___HTMLTAG_1261__HTMLTAG_1262__HTMLTAG_1263___ ___HTMLTAG_1264__HTMLTAG_1265___點選 指派角色___HTMLTAG_1267__HTMLTAG_1268__HTMLTAG_1269___ ___HTMLTAG_1270__HTMLTAG_1271___選擇要指派的領域角色或客戶端角色___HTMLTAG_1272__HTMLTAG_1273___

# Ví dụ gán role bằng Admin CLI
# Lấy service account user ID
SERVICE_ACCOUNT_ID=$(bin/kcadm.sh get clients/$CLIENT_UUID/service-account-user \
  -r my-company --fields id --format csv --noquotes)

# Gán realm role
bin/kcadm.sh add-roles -r my-company \
  --uusername service-account-my-service \
  --rolename admin

# Gán client role
bin/kcadm.sh add-roles -r my-company \
  --uusername service-account-my-service \
  --cclientid target-client \
  --rolename manage-users

# Script test Device Authorization Flow
#!/bin/bash
REALM=my-company
CLIENT_ID=cli-tool
KC_URL=http://localhost:8080

# Bước 1: Request device code
RESPONSE=$(curl -s -X POST \
  "$KC_URL/realms/$REALM/protocol/openid-connect/auth/device" \
  -d "client_id=$CLIENT_ID")

DEVICE_CODE=$(echo $RESPONSE | jq -r '.device_code')
USER_CODE=$(echo $RESPONSE | jq -r '.user_code')
VERIFY_URI=$(echo $RESPONSE | jq -r '.verification_uri_complete')
INTERVAL=$(echo $RESPONSE | jq -r '.interval')

echo "========================================"
echo "Mở URL sau trên browser:"
echo "$VERIFY_URI"
echo "Hoặc truy cập: $(echo $RESPONSE | jq -r '.verification_uri')"
echo "Nhập code: $USER_CODE"
echo "========================================"

# Bước 2: Polling for token
while true; do
  sleep $INTERVAL
  TOKEN_RESPONSE=$(curl -s -X POST \
    "$KC_URL/realms/$REALM/protocol/openid-connect/token" \
    -d "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
    -d "client_id=$CLIENT_ID" \
    -d "device_code=$DEVICE_CODE")

  ERROR=$(echo $TOKEN_RESPONSE | jq -r '.error // empty')
  if [ -z "$ERROR" ]; then
    echo "Xác thực thành công!"
    echo "Access Token: $(echo $TOKEN_RESPONSE | jq -r '.access_token' | head -c 50)..."
    break
  elif [ "$ERROR" = "authorization_pending" ]; then
    echo "Đang chờ user xác thực..."
  elif [ "$ERROR" = "slow_down" ]; then
    INTERVAL=$((INTERVAL + 5))
    echo "Slow down, tăng interval lên ${INTERVAL}s"
  else
    echo "Error: $ERROR"
    break
  fi
done