How to turn off authentification via browser

1

Greetings to all,

Could you please advise on how to allow authentication and authorization via Keycloak without redirecting to a browser? I have written a bash script, but it always gets stuck with the error message: “Error: no DISPLAY environment variable specified.” I want to run below script on the remote machine connected via ssh. Keycloak is another remote server.

`json_data=\`curl -k -d "grant_type=password" -d "scope=${scope}" -d "client_id=${client_id}" -d "client_secret=${client_secret}" -d "username=${username}" -d "password=${password}" ${oidc_url}```id_token=`echo $json_data | jq '.id_token' | tr -d '"'```refresh_token=`echo $json_data | jq '.refresh_token' | tr -d '"'```access_token=`echo $json_data | jq '.access_token' | tr -d '"'``

`### Print tokens`
`echo "ID_TOKEN=$id_token"; echo`
`echo "REFRESH_TOKEN=$refresh_token"; echo`
`echo "ACCESS_TOKEN=$access_token"; echo`
`### Introspect the id token`
`token=\`curl -k --user "${client_id}:${client_secret}" -d "token=${id_token}" ${oidc_url}/introspect```token_details=`echo $token | jq .```echo $token_details`

`# Set up credentials`
`kubectl config set-credentials ${username} \`
`--exec-api-version=client.authentication.k8s.io/v1beta1 \`
`--exec-command=kubectl \`
`--exec-arg=oidc-login \`
`--exec-arg=get-token \`
`--exec-arg=--oidc-issuer-url=${realm_url} \`
`--exec-arg=--oidc-client-id=${client_id} \`
`--exec-arg=--oidc-client-secret=${client_secret} \`
`--auth-provider-arg=refresh-token=${refresh_token} \`
`--auth-provider-arg=id-token=${id_token} \`
`--exec-arg=--insecure-skip-tls-verify`

Best regards,

Shakhizat

2

So far, the browser has nothing to do here, so you don’t have to “turn off” anything.
You are implementing the ROPC grant type. Therefore, it should return the tokens if the call was working properly.
Review your curl request, it should be something similar to (I just wrote down an example, I haven’t tested it)

curl \
-d "client_id=${client-id}" -d "client_secret=${client-secret}" \
-d "username=${username}" -d "password=${user-password}" \
-d "grant_type=password" \
-d "scope=${scopes}" \
https://${idp-domain}/realms/${realm-name}/protocol/openid-connect/token

On the other hand, in the instrospect endpoint you must send the access token [1].