Enabling authentication on bearer-only client in admin console

Securing applications
,
1

Hi,
I am facing the following issue with a bearer-only client for a resource server, which was set up in Keycloak 9.0.3:
Now in version 21.1.1, I don’t find a way in the admin console to enable the client authentication for example - the whole capability config section is missing in the configuration of this client.

In contrast to similar clients created in Keycloak 21.1.1, a tooltip text next to the client’s name reads “This is a special OIDC type. This client only allows bearer token requests and cannot participate in browser logins.” and in Keycloak’s database bearer_only = true is set.

Is there any way to convert this type of client so the authentication flows become available?

2

As I did not want to mess around with the client configuration in the DB, I tried the REST API and it allows in fact to update the bearer-only value and then the capability config shows up in the admin console.
Endpoints used:
GET {{authServerBaseUrl}}/admin/realms/{{authRealm}}/clients/:id
PUT {{authServerBaseUrl}}/admin/realms/{{authRealm}}/clients/:id