The scenario is, I want to manage authentication in several REST APIs deployed in different environments.

I've been reading about the Vault, and apparently, it has this feature.

With Vault is possible that my application only needs to make a request to the vault and be able to authenticate to an external API (properly configured) using only the alias? Without the need to store on my application user/password/token of the external API?

I wonder if anyone has had experience using Vault this way, and what are the pros and cons

Or if someone recommends something else to achieve this


I found a question like I was looking for on SO https://stackoverflow.com/questions/57703943/how-to-allow-single-sign-on-for-al-clients-in-keycloak

  • Rather than initiating a general discussion about the merits or demerits of a commercial service, you should ask specific technical questions about this service. – berndbausch Mar 8 at 23:10
  • @berndbausch I'm looking for a general recommendation of a way to achieve this – Guilherme Mar 9 at 0:08
  • I started the question asking about vault, because it was the first option that comes up – Guilherme Mar 9 at 0:09

Vault can authenticate its clients for its services. It can also delegate authentication to its services to say, GitHub or some OpenID connect provider.

But whatever method/protocol you choose, the pattern is always a client authenticates to Vault, not to your REST API.

Keycloak is more what you are looking for, as it is a general purpose Identity Provider.

The pattern you are looking for is something like this:

  1. API clients authentificate to an Identity Provider
  2. They get "something" in return, often a signed JSON Web Token (JWT)
  3. They send their JWT in the Authorization http header of their REST API call
  4. Whichever REST API receives the request validates the JWT signature using the Identity Provider's public key

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.