Last Update: 20 January 2019
In the previous article, we got to know Keycloak, an open source project for identity and access management developed by the RedHat Community. We went through how to install it, boot it and how to access the Keycloak Admin Console for the first time.
Continuing from where we left, in this new article I’d like to talk about how to configure Keycloak so that we can later use it for managing authentication and authorization for web applications and services. We’ll learn how to create a new realm, define roles and add users.
Throughout this series, we’re going to see more features and details about Keycloak, but I suggest you check the helpful and detailed official documentation for any doubt or curiosity.
1. Access Control, Authentication and Authorization
Managing authentication and authorization is an essential task in every good-designed web application or service. Keycloak makes it very easy and practical, letting us focus on the application business logic rather than on the implementation of security features.
Before going on, it is worth briefly recalling the definition of some fundamental security properties (from NIST glossary):
- Access Control: “The process of granting or denying specific requests to: 1) obtain and use information and related information processing services; and 2) enter specific physical facilities (e.g., federal buildings, military establishments, border crossing entrances)”.
- Authentication: “Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system”.
- Authorization: “Access privileges granted to a user, program, or process or the act of granting those privileges”.
A typical error is considering authorization and access control as synonyms when the second one is included in the first one. If you are interested in exploring this difference, there’s an interesting article by ICANN about it. Continue reading “Keycloak Basic Configuration for Authentication and Authorization”
