# Keycloak override Provider

**URL:** <https://forum.keycloak.org/t/keycloak-override-provider/20474>\
**Category:** Extending the server\
**Created:** [February 24, 2023, 6:51am UTC](https://forum.keycloak.org/t/keycloak-override-provider/20474 "2023-02-24T06:51:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vikram](https://avatars.discourse-cdn.com/v4/letter/v/e47774/32.png) [@vikram](https://forum.keycloak.org/u/vikram)\
**Post date:** [February 24, 2023, 6:51am UTC](https://forum.keycloak.org/t/keycloak-override-provider/20474/1 "2023-02-24T06:51:23Z")

</div>

We are currently running keycloak 19 having migrated from older version of keycloak (v4).  
Everything is going well, however, we noticed that due to some changes in the use of Base64Url decode v/s legacy Base64 decode (down to certain chars - + and /) we get illegal base64 string.

We want to extend or overwrite ClientIdAndSecretCredentialsProvider in which we can make relevant changes to handle base64 encode decode for backward compatibility.

Is there a way to do this via SPI mechanism ? If so, how we can go about doing it ?  
I did read in keycloak document about doing custom provider, but here we want to overwrite certain behavior for one of the provider classes keycloak comes with.

Would really appreciate some advice/suggestions 🙂

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [February 24, 2023, 8:25am UTC](https://forum.keycloak.org/t/keycloak-override-provider/20474/2 "2023-02-24T08:25:20Z")

</div>

Never overwrite an existing provider, instead, write your own provider or extend an existing provider with a custom provider and then set this new provider as default.  
This guide tells you how you configure providers as default: [Configuring providers - Keycloak](https://www.keycloak.org/server/configuration-provider#_configuring_a_default_provider)

---

<div class="post-metadata">

**Author:** ![vikram](https://avatars.discourse-cdn.com/v4/letter/v/e47774/32.png) [@vikram](https://forum.keycloak.org/u/vikram)\
**Post date:** [February 24, 2023, 8:49am UTC](https://forum.keycloak.org/t/keycloak-override-provider/20474/3 "2023-02-24T08:49:12Z")

</div>

Thank you for the response, so I did go through that but I guess part where I am not entirely sure is this.

1. I can extend the authenticator in my case: ClientIdAndSecretAuthenticator  
This class already extends AbstractClientAuthenticator which internally implements ClientAuthenticator, ClientAuthenticatorFactory

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/5/5f246f19a634e8eada664c694d9bf8b9aca43e10.png)  
 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/4/410b097f5238bb331931420b4194bd1ce57bbf83.png)

so custom class: CustomClientSecretAuthenticator extends ClientIdAndSecretAuthenticator

1. So would it then be okay to say I can just override method (authenticateClient) where I want to change the behavior for actual authentication
2. Package the jar file with META-INF/services/ having the file
3. Install this provider ? -spi-client-secret-provider=“client-secret”

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [February 24, 2023, 10:14am UTC](https://forum.keycloak.org/t/keycloak-override-provider/20474/4 "2023-02-24T10:14:35Z")

</div>

Ah, in case of the `client-authenticator` provider, there’s no default to set, you have to choose the one you want to use in your settings.

I’d strongly suggest to use a custom provider id, not re-using the `client-secret` id. This _might_ work, but could also go wrong.

When deploying your custom provider, you should be able to see it in the “Provider Info” tab in master realm of admin ui:  
 ![image 2023-02-24 um 11.09.57](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/a/a1da1cbc14648b022609752c1bfb37e1115e5d50.png)

You have to create a custom authentication flow for client authentication and bind it to the client flow:

 ![image 2023-02-24 um 11.12.08](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/b/b652329d263386ce00a527534f77efa3c5260ffc.png)

Then, in client settings, you should be able to choose the proper one:

 ![image 2023-02-24 um 11.11.30](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/6/6117c0d52f41ff910319d527ca57aa375aba58d3.png)

That should basically be the steps to do.

---

<div class="post-metadata">

**Author:** ![vikram](https://avatars.discourse-cdn.com/v4/letter/v/e47774/32.png) [@vikram](https://forum.keycloak.org/u/vikram)\
**Post date:** [February 24, 2023, 11:43am UTC](https://forum.keycloak.org/t/keycloak-override-provider/20474/5 "2023-02-24T11:43:43Z")

</div>

Thank you so much all the help and advice. Will try it out and revert back, but it does clarify lot of doubts around it. Thank you so much :).