# Custom Login Using Keycloak OpenID API

**URL:** <https://forum.keycloak.org/t/custom-login-using-keycloak-openid-api/11918>\
**Category:** Securing applications\
**Tags:** authentication\
**Created:** [November 6, 2021, 1:07am UTC](https://forum.keycloak.org/t/custom-login-using-keycloak-openid-api/11918 "2021-11-06T01:07:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ahssu101](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Ahssu101](https://forum.keycloak.org/u/Ahssu101)\
**Post date:** [November 6, 2021, 1:07am UTC](https://forum.keycloak.org/t/custom-login-using-keycloak-openid-api/11918/1 "2021-11-06T01:07:54Z")

</div>

I have a web app that I want to authenticate using Keycloak. After login, I need to check and show the content according to the user role. Can I use Keycloak OpenID API i.e. **[http://localhost:8080/auth/realms/{realm-name}/protocol/openid-connect/token](http://localhost:8080/auth/realms/%7Brealm-name%7D/protocol/openid-connect/token)** for custom login authentication into the app and then check the user roles manually using Keycloak Admin API’s after getting the **access token** , or is there any other way using the default Keycloak login page?

I have searched a lot but haven’t got a proper answer for this.

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [November 6, 2021, 8:53am UTC](https://forum.keycloak.org/t/custom-login-using-keycloak-openid-api/11918/2 "2021-11-06T08:53:36Z")

</div>

You can map the user roles into the access/id token itself, then you won’t need to call an additional API. Take a look at the documentation here [Server Administration Guide](https://www.keycloak.org/docs/latest/server_admin/#_protocol-mappers) and post here if you have specific questions.

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [November 6, 2021, 1:01pm UTC](https://forum.keycloak.org/t/custom-login-using-keycloak-openid-api/11918/5 "2021-11-06T13:01:36Z")

</div>

You want to use the OpenID Connect browser flow “authorization code flow”. There is no OIDC “API”.  
Using the ROPC is deprecated: [draft-ietf-oauth-security-topics-18](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-18#section-2.4)  
Don’t use custom login pages in your app, use Keycloak as your auth server!

---

<div class="post-metadata">

**Author:** ![Ahssu101](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Ahssu101](https://forum.keycloak.org/u/Ahssu101)\
**Post date:** [November 7, 2021, 12:10am UTC](https://forum.keycloak.org/t/custom-login-using-keycloak-openid-api/11918/6 "2021-11-07T00:10:15Z")

</div>

If I use the Kyecloak auth server how will I get the User Role after logging into the system that was my question?  
Because in the OpenID-Connect API I can get roles in the access tokens.

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [November 7, 2021, 8:10am UTC](https://forum.keycloak.org/t/custom-login-using-keycloak-openid-api/11918/7 "2021-11-07T08:10:11Z")

</div>

You get an access\_token also from the auth code flow.  
Do yourself a favor and read and understand the OIDC spec and flows more. Authentication is more than just calling an API.