Understanding authentication flows
In Keycloak, authentication is driven by a set of sequential steps or executions that are grouped together to define how the identity should be verified, depending on the authentication flow. Depending on the flow, the authentication requirements, as well as the steps to verify the identity of the actor trying to authenticate into a realm, changes.
Keycloak has a set of well-defined flows representing how end users and clients – the actors – can authenticate into a realm. For end users, the authentication flow usually involves using the browser as an intermediary. The steps for the clients are based on backchannel requests to the token endpoint.
Keycloak is very flexible in terms of how you can define these flows. By default, realms are created with built-in definitions that cover the most common requirements to authenticate end users and clients, which you can change or extend any time to address your own authentication requirements...
