title: Keycloak client deployment best practice
body: <p>So I want to deploy a client-app (java, with spring security, if that matters) to different companies. The keycloak will obviously run on servers of my organization but the client-app as to run on the servers of the client-companies.</p>
  <ol>
  <li>Should the keycloak-client's access type be public or confidential?</li>
  <li>i.e. what is the client-secret used for? (Encryption)?</li>
  <li>Is it therefore a problem if the companies admins can theoretically read the secret by decompiling the jar of the client-app I give them?</li>
  </ol>
  <p>Concerning the valid redirect URIs: Idealy I would like to use grant-type: password, so the user of the company enters his credentials into the frontend of the company deployed client-app and it logs into keycloak. Potentially the client-app deployed in the company is only reacable from the company intranet.</p>
  <ol start="4">
  <li>What can the redirect URI be for this case?</li>
  </ol>