Last Update: 20 January 2019
Lately, I’ve been working with Keycloak, so I decided to better delve into it and write about it.
This article is the first of a series where I’d like to introduce Keycloak as a solution to manage authentication and authorization, how to install it and which are the fundamental concepts and configurations.
Then I’d like to explain how to use it to secure Spring Boot, Spring Security and AngularJS applications and services, analyse the implementation when using a relational database to store users and finally how to manage users from Java thanks to the Admin REST API.
1. What is Keycloak?
Keycloak is an open source project developed and maintained by the RedHat Community.
“Keycloak is an open source Identity and Access Management solution aimed at modern applications and services. It makes it easy to secure applications and services with little to no code.”
It offers a broad set of features, like SSO, authentication and authorization, social login, multifactor authentication and centralised user management. I suggest you check the official documentation to get all the details.
Throughout this series we’ll make use of the following features:
- Admin Console to configure the Keycloak server and create realms, roles, users and clients;
- Single Sign-On (SSO) using the Open ID Connect (OIDC) authentication and authorization protocol;
- Client Adapters to integrate Spring Boot, Spring Security and AngularJS with Keycloak;
- Admin REST API for user management.