# Client access type: can't edit the client secret entry **URL:** \ **Category:** Getting advice\ **Created:** [August 26, 2022, 4:50pm UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111 "2022-08-26T16:50:34Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![thommierother](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thommierother/32/5897_2.png) [@thommierother](https://forum.keycloak.org/u/thommierother)\ **Post date:** [August 26, 2022, 4:50pm UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111/1 "2022-08-26T16:50:34Z")
Environment: Keycloak 18 or 19 (just upgraded to 19) Error: I have an android application with a pre-defined client-id and a pre-defined client secret (see > **[OpenID Connect (OIDC)](https://doc.owncloud.com/server/next/admin_manual/configuration/user/oidc/oidc.html#client-support-for-oidc)** > > OpenID Connect (OIDC) I would like to enter this client into my realm, but I have no selection _access type = confidential_ and the client secret is always pre-created upon creating the client settings. From the android client side I see “_unknown parameter: redirect\_uri_” and the kc log shows: ```auto 2022-08-26 16:38:35,387 WARN [org.keycloak.services] (executor-thread-11) KC-SERVICES0101: Failed to verify remote host : 87.154.171.4 2022-08-26 16:38:35,390 WARN [org.keycloak.services] (executor-thread-11) KC-SERVICES0099: Operation 'before register client' rejected. Policy 'Trusted Hosts' rejected request to client-registration service. Details: Host not trusted. 2022-08-26 16:38:35,391 WARN [org.keycloak.events] (executor-thread-11) type=CLIENT_REGISTER_ERROR, realmId=netzwissen, clientId=null, userId=null, ipAddress=87.154.171.4, error=not_allowed, client_registration_policy='Trusted Hosts' 2022-08-26 16:38:36,355 WARN [org.keycloak.events] (executor-thread-11) type=LOGIN_ERROR, realmId=netzwissen, clientId=e4rAsNUSIUs0lF4nbv9FmCeUkTlV9GdgTLDH1b5uie7syb90SzEVrbN7HIpmWJeD, userId=null, ipAddress=87.154.171.4, error=client_not_found ``` Whats wrong here? Why is the input field for client-secret not editable? Why can’t I select between different access types, as it is documented in [https://wjw465150.gitbooks.io/keycloak-documentation/content/server\_admin/topics/clients/oidc/confidential.html](https://wjw465150.gitbooks.io/keycloak-documentation/content/server_admin/topics/clients/oidc/confidential.html) ---
**Author:** ![gsmith](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/gsmith/32/294_2.png) [@gsmith](https://forum.keycloak.org/u/gsmith)\ **Post date:** [August 26, 2022, 11:41pm UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111/2 "2022-08-26T23:41:32Z")
Hello, I haven had this issue before, but what I get from the logs provide is… - Failed to verify remote host : 87.154.171.4 - Operation ‘before register client’ rejected. Policy ‘Trusted Hosts’ rejected request to client-registration service. Details: Host not trusted. By chance is there certificated being used? or a firewall on this node? > **[Configuring trusted certificates for outgoing requests - Keycloak](https://www.keycloak.org/server/keycloak-truststore)** > > Keycloak is an open source identity and access management solution As for > [@thommierother](#): > > Why can’t I select between different access types, as it is documented in [Confidential Client Credentials | keycloak-documentation](https://wjw465150.gitbooks.io/keycloak-documentation/content/server_admin/topics/clients/oidc/confidential.html) Not sure what your settings are or how you configured this environment. ---
**Author:** ![thommierother](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thommierother/32/5897_2.png) [@thommierother](https://forum.keycloak.org/u/thommierother)\ **Post date:** [August 27, 2022, 8:01am UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111/3 "2022-08-27T08:01:35Z")
Keycloak is running behind a haproxy load balancer which is used for ssl termination. I use proxy=edge, as described in [Using a reverse proxy - Keycloak](https://www.keycloak.org/server/reverseproxy). And I saw that I **did not finish the config for this correctly yet** , as described in [Using a reverse proxy - Keycloak](https://www.keycloak.org/server/reverseproxy) I now added the “Enable the corresponding proxy provider” and “Configure the HTTP headers” steps to prepary for haproxy proxying and restarted the keycloak. The “‘Trusted Hosts” and “failed to verify” errors are gone. ```auto Current Configuration: kc.cache = ispn (PersistedConfigSource) kc.config.built = true (SysPropConfigSource) kc.db = postgres (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf]) kc.db-password = ******* (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf]) kc.db-url = jdbc:postgresql://10.10.10.18/keycloak (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf]) kc.db-username = keycloak (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf]) kc.health-enabled = false (PersistedConfigSource) kc.hostname = login.netzwissen.de (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf]) kc.http-enabled = false (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.1.jar!/META-INF/keycloak.conf]) kc.http-relative-path = / (PersistedConfigSource) kc.log = console,file (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf]) kc.log-console-output = default (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.1.jar!/META-INF/keycloak.conf]) kc.log-file = /var/log/keycloak/keycloak.log (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf]) kc.log-level = info (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf]) kc.metrics-enabled = false (PersistedConfigSource) kc.provider.file.postgresql-42.3.5.jar.last-modified = 1652811176344 (PersistedConfigSource) kc.proxy = edge (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf]) kc.spi-map-storage-concurrenthashmap-dir = ${kc.home.dir:default}${file.separator}data${file.separator}chm (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.1.jar!/META-INF/keycloak.conf]) kc.spi-map-storage-concurrenthashmap-key-type-authz-resource-servers = string (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.1.jar!/META-INF/keycloak.conf]) kc.spi-map-storage-concurrenthashmap-key-type-realms = string (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.1.jar!/META-INF/keycloak.conf]) kc.spi-map-storage-concurrenthashmap-key-type-single-use-objects = string (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.1.jar!/META-INF/keycloak.conf]) kc.version = 19.0.1 (SysPropConfigSource) ``` But when creating clients, I still dont see an option to select “confidential client” and enter any pre-defined credentials ![ody_20220827_095232](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/e/ea76981a46d2686835696d2ffc6378b4db228bd4.png) Thats strange … ---
**Author:** ![thommierother](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thommierother/32/5897_2.png) [@thommierother](https://forum.keycloak.org/u/thommierother)\ **Post date:** [August 27, 2022, 8:08am UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111/4 "2022-08-27T08:08:55Z")
And now I see the reason why I can not connect with the android app: ```auto 2022-08-27 08:03:10,758 WARN [org.keycloak.events] (executor-thread-11) type=REFRESH_TOKEN_ERROR, realmId=netzwissen, clientId=e4rAsNUSIUs0lF4nbv9FmCeUkTlV9GdgTLDH1b5uie7syb90SzEVrbN7HIpmWJeD, userId=null, ipAddress=87.183.227.22, error=invalid_client_credentials, grant_type=refresh_token 2022-08-27 08:03:11,347 WARN [org.keycloak.services.x509.AbstractClientCertificateFromHttpHeadersLookup] (executor-thread-11) HTTP header "" is empty 2022-08-27 08:03:11,348 WARN [org.keycloak.services.x509.AbstractClientCertificateFromHttpHeadersLookup] (executor-thread-11) HTTP header "" is empty 2022-08-27 08:03:11,349 WARN [org.keycloak.events] (executor-thread-11) type=REFRESH_TOKEN_ERROR, realmId=netzwissen, clientId=e4rAsNUSIUs0lF4nbv9FmCeUkTlV9GdgTLDH1b5uie7syb90SzEVrbN7HIpmWJeD, userId=null, ipAddress=87.183.227.22, **error=invalid_client_credentials,** grant_type=refresh_token ``` That makes sense, as I could not add the pre-defined credentials as they are defined in the Owncloud Docs mentioned earlier. So the main question still is “why does keycloak not allow to enter a pre-defined client secret” ? ---
**Author:** ![gsmith](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/gsmith/32/294_2.png) [@gsmith](https://forum.keycloak.org/u/gsmith)\ **Post date:** [August 29, 2022, 10:59pm UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111/5 "2022-08-29T22:59:52Z")
> [@thommierother](#): > > But when creating clients, I still dont see an option to select “confidential client” and enter any pre-defined credentials This is odd, What I just noticed & comparing it to mine was that yours States “ **Create Clien** t” and mine KC “19.0” shows Add client. ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/9/9d5bfea771c5bf08d8bb7e8a82a9894e99947091.png) Have you tried just to create the client and go back in to adjust it? ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/0/0b47d11297691b91c2a5721c51119a45dab9e018.png) ---
**Author:** ![thommierother](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thommierother/32/5897_2.png) [@thommierother](https://forum.keycloak.org/u/thommierother)\ **Post date:** [August 30, 2022, 7:19am UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111/6 "2022-08-30T07:19:09Z")
Hmmmm, the whole UI looks different here with KC 19.01: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/4/415eded73a890fd9b83482e0c31dab07702ac1f1.png) For the flows I have these options: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/8/813bb013366e165cf2a609b02e60f403ed70e308.png) But there may be another option (more or less a “workaround”): it is possible to import the client settings from a json file. This link describes how to import client settings with a pre-defined secret, this is exactly what I need: > I will try this and keep you updated 😉 ---
**Author:** ![gsmith](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/gsmith/32/294_2.png) [@gsmith](https://forum.keycloak.org/u/gsmith)\ **Post date:** [August 31, 2022, 4:29am UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111/7 "2022-08-31T04:29:27Z")
Oh wow, yeah the whole Web UI looks different. > [@thommierother](#): > > I will try this and keep you updated 👍 ---
**Author:** ![thommierother](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thommierother/32/5897_2.png) [@thommierother](https://forum.keycloak.org/u/thommierother)\ **Post date:** [August 31, 2022, 8:26pm UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111/8 "2022-08-31T20:26:35Z")
I could solve my problem and its much easier than I thought: - There are config examples for keycloak as an IDP for owncloud, provided as json in [ocis/deployments/examples/ocis\_keycloak/config/keycloak at master · owncloud/ocis · GitHub](https://github.com/owncloud/ocis/tree/master/deployments/examples/ocis_keycloak/config/keycloak) - Your can edit these examples, add the correct client secret and import them directly into the keycloak realm. ---
**Author:** ![ezesil](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ezesil/32/7625_2.png) [@ezesil](https://forum.keycloak.org/u/ezesil)\ **Post date:** [February 3, 2023, 8:16pm UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111/9 "2023-02-03T20:16:11Z")
Client Authentication is the new public/confidential “switch” for clients in the latest version. It also causes CODE\_TO\_TOKEN\_ERROR with invalid\_client\_credentials message and might produce 400, 401, or 403 error code depending on the browser and UI. I solved it thanks to this thread. Everything works flawlessly now. ---
**Author:** ![elwanov](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/elwanov/32/8687_2.png) [@elwanov](https://forum.keycloak.org/u/elwanov)\ **Post date:** [June 1, 2023, 9:46am UTC](https://forum.keycloak.org/t/client-access-type-cant-edit-the-client-secret-entry/17111/10 "2023-06-01T09:46:56Z")
Hi All Simply, follow the below steps: 1. from “Settings” tab, you can turn on “Client authentication” property. 2. After enabling it, two new tabs “Keys” and “Credentials” will be appeared. 3. Now, you can get “Client secret” from Credentials tab.