Skip to main content
Version: 1.2.0

Configuration of Keycloak for PAT exchange

Introduction​

The configuration below is required when using the functionality of exchanging Personal Access Tokens (PAT) for access tokens, for example, when using H2O Drive.

When user is authenticated via Feature Store personal access token, exchange between this PAT and platform access token is required in case interacting with cloud components (Drive/GTPe).

Register new client in the realm​

  • Select realm from drop-down
  • Click Clients on the left panel and click Create client
  • Select OpenID Connect in Client type
  • Provide Client ID for example feature-store-pat
  • Provide Name for example feature-store-pat
  • Click Next

image

  • Select Client authentication
  • Select Standard flow , Direct access grants, Service accounts roles
  • Click Next

image

  • Select Client authentication
  • Select Standard flow , Direct access grants, Service accounts roles
  • Click Next

After creating the client, click on tab Service accounts roles and assing role.

  • Select impersonation role

image

Deployment​

Please start keycloak with parameter: -Dkc.features=token-exchange or KC_FEATURES=token-exchange

Feedback