Not able to pass a client secret for OIDC KEYCLOAK

[abhi0698]

• We need to enable client authentication in keycloak for controlling public access but after enabling that need to pass 'client secret' along with client id from dependency track ui but where can i get that variable...

[valentijnscholten]

DT uses a public client as it's all handled in the browser, so a secret would instantly become public which defeats the purpose of a secret. There's still protection in place by making sure only valid redirect urls are allowed by your IdP (Keycloak).

[abhi0698]

Thanks for the reply,

I'm trying to control the DT access to a specific group only. So, can you suggest any idea how we can achieve this using a keycloak as IDP.

Thanks.