Spring security authentication with OAuth2 provider via username/password form - spring-security

Question

I'm writing an application secured with Spring Security.
I want to achieve 2 objectives:
Application in the background is using Keycloak as auth server (this is under my control).
I want the user to be able to log in by default login form in the application, so the user doesn't need to be forwarded to the authentication page of Keycloak.
The desired solution is to use features of
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>
The logins enabled are:
#Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2Login(withDefaults())
.formLogin(withDefaults());
return http.build();
}
I now how to obtain access token from Keycloak but don't know if I can use it to set OAuth2 context in spring security.
I could not find any example of how to do it with the AuthorizationGrantType password.

Answer 1

You are referring to "Password grant" flow and it has been deprecated. You should not use that (like REALLY not).
To authenticate users, use authorization-code flow (with the redirection to the authorization-server). There are several good reason for that:
security concerns
this the (strongly) recommanded way (because of above)
if you do not use your authorization-server screens, then you'll probably have to implement other features than just username / password form (registration, Multi Factor Authentication, profile édition,...)
If your concern is look and feel, consider defining a Keycloak theme. This will allow you to take control of all the Keycloak screens your users could see.