Configure Keycloak for Application-Mediated Access
Configure Keycloak to issue end-user and database-access tokens for applications that connect to Oracle AI Database on behalf of their end users.
Oracle Deep Data Security supports Keycloak as a configurable OAuth 2.0 provider. The database uses these Keycloak-issued tokens to establish end-user security contexts.
This chapter provides an example of the Keycloak configuration for a Graalbase deployment. Graalbase is a backend-as-a-service platform built on Oracle AI Database. In this example, browser applications access the database through Oracle REST Data Services (ORDS). See About Oracle REST Data Services.
The browser application uses the Graalbase SDK to sign in the end user and obtain an end-user token from Keycloak. The application includes this token in requests to ORDS. As a confidential client in Keycloak, ORDS uses its client credentials to obtain a separate database-access token. ORDS passes both tokens to the database in the end-user security context payload.