Configure Clients and Audiences

Set up the application client and token audiences in Keycloak for application-mediated access.

Register the application that connects to the database as a confidential client. In this configuration, ORDS performs this role and uses its client credentials to obtain a database-access token.

Perform the following tasks in Keycloak:

1. Choose the audience value that identifies the database resource. This example uses db_app. Use the same value for audience in the database identity provider configuration.

2. Register ORDS as an OpenID Connect confidential client with the client ID ords_client. Enable client authentication and the service account for the client credentials flow. Configure the client credentials that ORDS uses to obtain its database-access token.

3. Configure a hard-coded audience mapper so that the database-access token obtained by ORDS includes db_app in its aud claim. Ensure that the token’s client_id claim contains ords_client, the Keycloak client ID registered for ORDS.

4. Configure end-user sign-in for the browser application. Ensure that the end-user token issued by Keycloak includes ords_client in its aud claim and carries the end user’s identity and realm roles. The browser application includes this token in requests to ORDS. ORDS passes the end-user token and its database-access token to the database in the end-user security context payload.

See Creating an OpenID Connect client, Using a service account, and Hardcoded audience in Keycloak Server Administration Guide.