Perform Required actions to get access token in Postman

[Gayathri Balasubramanian]

Hi there,

I have a custom keycloak flow in case of user login. Once the user enters the username and password, they will be sent an OTP via SMS to verify their account(mobile number). On success, the access_token is retrieved. In other words, they will be allowed to login. 

I am trying to get the access token via POSTMAN for testing purposes. Is there a way we can replicate this action in Postman? Appreciate any help!

Thanks

Gayathri

[Nivas Ganesan]

Hi Gayathri,

In keycloak you will have authentication flow for user browser flow and direct grant flow.If client is enabled with Direct Access Grants Enabled then direct grant will be used.Make sure following configurations are done in keycloak realm configuration.

Step 1  Browser flow (OTP required) : Choose realm -> authentication -> Flows -> browser flow

Step 2  Direct grant flow (OTP not required for grant type password) : Choose realm -> authentication -> Flows -> direct grant flow (drop down)

Step 3  Bindings : Choose realm -> authentication -> bindings -> configure browser flow and direct grant flow with above ones

Step 4 Enable Required Actions : Choose realm -> Authentication -> Required Actions -> Configure otp

Step 5  Client Configurations : Choose realm -> clients -> settings -> Enable Direct Grant Access oauth flow

OR

 Step There is Option to override authentication flow for specific client as well.

realm -> clients -> settings -> Authentication flow overrides - this flow will take precedence

- Now you can use the curl for grant Type password to get access token without otp

curl --location --request POST '<TOKEN_ENDPOINT>' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=<CLIENT_ID>' \
--data-urlencode 'username=<USERNAME>' \
--data-urlencode 'password=<USER_CREDENTIAL>' \
--data-urlencode 'grant_type=password'

Hope this helps,

Thanks,

Nivas.