# OIDC Newbie - Usage scenario

**URL:** <https://forum.keycloak.org/t/oidc-newbie-usage-scenario/28922>\
**Category:** Getting advice\
**Tags:** authentication, oidc\
**Created:** [November 25, 2024, 12:38pm UTC](https://forum.keycloak.org/t/oidc-newbie-usage-scenario/28922 "2024-11-25T12:38:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chris910512](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/chris910512/32/11676_2.png) [@chris910512](https://forum.keycloak.org/u/chris910512)\
**Post date:** [November 25, 2024, 12:38pm UTC](https://forum.keycloak.org/t/oidc-newbie-usage-scenario/28922/1 "2024-11-25T12:38:25Z")

</div>

Hi folks,  
I’m new to Keyclaok and also OIDC protocols.

I’ve successfully built a Spring Boot application with Keycloak, and I created one realm and one client there. I could also get JWT of the client with client-secret.

However, this practice is client-base and what I want to do is getting JWT by each user.

Suppose I have…

RealmA

- ClientA: UserA, UserB…
- ClientB: UserC, UserD…

Is there way that I can get JWT of UserA to UserD with OIDC way?  
I’ve found it can be implemented using id-password base though, should I need to use login way if I want to make it user-base or is there any other way to fulfil it using OIDC?

Thanks

---

<div class="post-metadata">

**Author:** ![embesozzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/embesozzi/32/12390_2.png) [@embesozzi](https://forum.keycloak.org/u/embesozzi)\
**Post date:** [November 25, 2024, 6:55pm UTC](https://forum.keycloak.org/t/oidc-newbie-usage-scenario/28922/2 "2024-11-25T18:55:46Z")

</div>

There is no direct link between the client and the user. This means that the user attempts to log in to an app related to a client that implements one of the OIDC standards (usually Authorization Code or Authorization Code + PKCE) with your IdP.

Therefore, based on your example, Users A, B, C, and D can log in to AppA (ClientA) or AppB (ClientB) without any issues.

In Spring Boot, you can easily use the `spring-boot-starter-oauth2-client`.

---

<div class="post-metadata">

**Author:** ![chris910512](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/chris910512/32/11676_2.png) [@chris910512](https://forum.keycloak.org/u/chris910512)\
**Post date:** [November 27, 2024, 9:55am UTC](https://forum.keycloak.org/t/oidc-newbie-usage-scenario/28922/3 "2024-11-27T09:55:41Z")

</div>

Thank you for your comment
