title: Keycloak: How to make authentication automatic for logged-in Windows user?
body: <p>I'm trying to create a <strong>C# application</strong> which would use <strong>Keycloak</strong> for <strong>authentication</strong>. Currently, I'm able to log in as user using <em>OpenID Connect</em> by sending the following REST request:</p>
  
  <pre><code>POST
  http://{server}:{port}/auth/realms/{myRealm}/protocol/openid-connect/token
  
  Body (x-www-form-urlencoded):
      client_id    {myClient}
      username     FooBar
      password     {userPassword}
      grant_type   password
  </code></pre>
  
  <p>Sending this request results in acquiring both <em>access token</em> and <em>refresh token</em>.</p>
  
  <p>Now, I would like to be able to somehow login (acquire the tokens or otherwise authenticate the user) using the <em>"currently active Windows session"</em> by which I mean that the user (existing in <strong>Active Directory LDAP</strong>) which is currently logged into Windows should be authenticated without providing any credentials.</p>
  
  <p>The <em>User Federation</em> in my Keycloak realm already contains configuration for the AD LDAP server so all the users are now also available in the Keycloak.</p>
  
  <p>I went through the Keycloak documentation (especially the sections about <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#_ldap" rel="noreferrer">LDAP and Active Directory</a> and <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#_kerberos" rel="noreferrer">Kerberos</a>) but didn't quite understand what exactly needs to be done in order to make it work.</p>
  
  <p>I also searched here on SO but the only relevant thing I've found is <a href="https://stackoverflow.com/questions/2453769/active-directory-as-openid-provider#51777485">some other user mentioning that this should be possible</a>.</p>
  
  <p><strong>Can someone point me in the right direction?</strong></p>