<!--
  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
  ~ and other contributors as indicated by the @author tags.
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~ http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<chapter id="access-types">
    <title>Client Access Types</title>
    <para>
        When you create a Client in admin console you may be wondering what the "Access Types" are.
    </para>
    <para>
        <variablelist>
            <varlistentry>
                <term>confidential</term>
                <listitem>
                    <para>
                        Confidential access type is for clients that need to perform a browser login and that you want
                        to require a client secret when they turn an access code into an access token, (see
                        <ulink url="http://tools.ietf.org/html/rfc6749#section-4.1.3">Access Token Request</ulink> in
                        the OAuth 2.0 spec for more details).  The advantages of this is that it is a little extra security.
                        Since Keycloak requires you to register valid redirect-uris, I'm not exactly sure what this little
                        extra security is though. :)
                        The disadvantages of this access type is that confidential access type is pointless for pure
                        Javascript clients as anybody could easily figure out your client's secret!
                    </para>
                </listitem>
            </varlistentry>
            <varlistentry>
                <term>public</term>
                <listitem>
                    <para>
                        Public access type is for clients that need to perform a browser login and that you feel
                        that the added extra security of confidential access type is not needed.  FYI, Pure javascript
                        clients are by nature public.
                    </para>
                </listitem>
            </varlistentry>
            <varlistentry>
                <term>bearer-only</term>
                <listitem>
                    <para>
                        Bearer-only access type means that the application only allows bearer token requests.  If this
                        is turned on, this application cannot participate in browser logins.
                    </para>
                </listitem>
            </varlistentry>
            <varlistentry>
                <term>direct access only</term>
                <listitem>
                    <para>
                        You would also see a "Direct Access Only" switch when creating the Client.
                        This switch is for clients that only use the  <link linkend='direct-access-grants'>Direct Access Grant</link>
                        protocol to obtain access tokens.
                    </para>
                </listitem>
            </varlistentry>
        </variablelist>
    </para>
</chapter>