Getting the current users access token in a Keycloak SPI/Provider (at initial login)

Question

How do i get access to the currently authenticated users access token in a Keycloak Service Provider Interface when the user has just logged in?

Current situation: I am doing a manual Password Grant with Apache HttpClient inside a custom User Federation/Storage Provider when the user is performing a login with username and password.

The users access token is then used to call an internal API with his authentication context. This API call with the users bearer token is required for auditing/GDPR purposes since the user gives multiple consents when logging in.

I am assuming there is no way to get the current users authentication context within a user storage provider since the user is not yet authenticated at that point in time, right? Is password grant the correct way to obtain a user auth context/token at that time? Another option might be to chain SPIs, e.g. use an Authentication SPI and intercept the token there. But it seems you cannot overwrite an existing Auth flow. The last and maybe best option would be to create an Event Listener Provider. But do i have access to the access token there?

I would really appreciate some input because this whole endeavour feels a bit off.

Answer 1

Another option (which makes more sense for me) would be to use a client id to authenticate as a service (client authentication), in order to perform the auditing. That way you don't even need the user to be authenticated at that point. I see it as a better solution, since, apart what I have said, auditing is actually a system related chore. If you let any user do auditing, they could script some code with a valid token to perform massive/fake auditings by their own.

It makes more sense to leave it to a concrete client, with a concrete role and request that role for the auditing process.