title: Keycloak public client and authorization
body: <p>We are using keycloak-adapter with Jetty for authentication and authorization using Keycloak.
  As per <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#_oidc-auth-flows" rel="noreferrer">Keycloak doc for OIDC Auth flow</a>:</p>
  
  <blockquote>
    <p><strong>Another important</strong> aspect of this flow is the concept of a <strong>public vs. a confidential</strong> client.   Confidential clients are required to
    provide a client secret when they exchange the temporary codes for
    tokens. Public clients are not required to provide this client secret.
    Public clients are perfectly fine so long as HTTPS is strictly
    enforced and you are very strict about what redirect URIs are
    registered for the client.</p>
    
    <p>HTML5/JavaScript clients always have to be public clients because
    there is no way to transmit the client secret to them in a secure
    manner.</p>
  </blockquote>
  
  <p>We have webapps which connect to Jetty and use auth. So, we have created a public client and it works awesome for webapp/REST authentication.<br>
  The problem is as soon as we enable authorization, client type gets converted to Confidential from Public and it does not allow the reset it as Public. Now, we are in soup. We cannot have public clients due to authorization and we cannot connect webapps to confidential client.<br>
  This seems to be contradictory to us. Any idea why client needs to be confidential for authorization? Any help on this how can we overcome this issue?<br>
  Thanks.</p>