title: Keycloak x509 client authentication configuration
body: <p>I need some tips in order to understand how to perform a client authentication with x509 certificate against Keycloak.</p>
  
  <p>We have a simple Spring Boot Web App (API REST) into a Kubernetes cluster.
  This Web App is public exsposed through an API Gateway (Ambassador) and currently protected with a browser redirection to the Keycloak login page where user can input his username and password.</p>
  
  <p>However this is not what we want.
  What is necessary for us is a client authentication (React Native Mobile App) where:</p>
  
  <ul>
  <li>Mobile App try to call our Server API REST endpoints </li>
  <li>Ambassador check for a valid access token and (if not) respond with a 403 http status (no browser redirection)</li>
  <li>Mobile App then redirect to Keycloak in order to perform the authentication</li>
  <li>Keycloak doesn't show username/password login page but, instead, Mobile App pass a x509 user certificate through its Browser.</li>
  </ul>
  
  <p>Unfortunately I can't understand how to generate a valid and trusted x509 certificate with user data (info, roles ecc.) in order to get an access token from the IdP.</p>
  
  <p>And ... how can IdP check and validate this client certificate? Is it necessary a Server certificate counterpart somewhere installed on Keycloak?</p>
  
  <p>What's the correct form (ex with CURL) to pass the client certificate to keycloak?
  Is it neccessary to pass also the private key and why?</p>