Book Image

Keycloak - Identity and Access Management for Modern Applications - Second Edition

By : Stian Thorgersen, Pedro Igor Silva

4.8 (5)

Book Image

Keycloak - Identity and Access Management for Modern Applications - Second Edition

4.8 (5)

By: Stian Thorgersen, Pedro Igor Silva

Overview of this book

The second edition of Keycloak - Identity and Access Management for Modern Applications is an updated, comprehensive introduction to Keycloak and its updates. In this new edition, you will learn how to use the latest distribution of Keycloak. The recent versions of Keycloak are now based on Quarkus, which brings a new and improved user experience and a new admin console with a higher focus on usability. You will see how to leverage Spring Security, instead of the Keycloak Spring adapter while using Keycloak 22. As you progress, you’ll understand the new Keycloak distribution and explore best practices in using OAuth. Finally, you'll cover general best practices and other information on how to protect your applications. By the end of this new edition, you’ll have learned how to install and manage the latest version of Keycloak to secure new and existing applications using the latest features.

Preface

Who this book is for

What this book covers

To get the most out of this book

Getting Started with Keycloak

Getting Started with Keycloak

Technical requirements

Introducing Keycloak

Installing and running Keycloak

Discovering the Keycloak admin and account consoles

Free Chapter

Securing Your First Application

Securing Your First Application

Technical requirements

Understanding the sample application

Running the application

Understanding how to log in to the application

Securely invoking the backend REST API

Brief Introduction to Standards

Brief Introduction to Standards

Authorizing application access with OAuth 2.0

Authenticating users with OpenID Connect

Leveraging JWT for tokens

Understanding why SAML 2.0 is still relevant

Authenticating Users with OpenID Connect

Authenticating Users with OpenID Connect

Technical requirements

Running the OpenID Connect playground

Understanding the Discovery endpoint

Authenticating a user

Understanding the ID token

Invoking the UserInfo endpoint

Dealing with users logging out

Further reading

Authorizing Access with OAuth 2.0

Authorizing Access with OAuth 2.0

Technical requirements

Running the OAuth 2.0 playground

Obtaining an access token

Requiring user consent

Limiting the access granted to access tokens

Validating access tokens

Further reading

Securing Different Application Types

Securing Different Application Types

Technical requirements

Understanding internal and external applications

Securing web applications

Securing native and mobile applications

Securing REST APIs and services

Further reading

Integrating Applications with Keycloak

Integrating Applications with Keycloak

Technical requirements

Choosing an integration architecture

Choosing an integration option

Integrating with Golang applications

Integrating with Java applications

Integrating with JavaScript applications

Integrating with Node.js applications

Using a reverse proxy

Try not to implement your own integration

Further reading

Authorization Strategies

Authorization Strategies

Understanding authorization

Using OAuth2 scopes

Using Keycloak as a centralized authorization server

Further reading

Configuring Keycloak for Production

Configuring Keycloak for Production

Technical requirements

Setting the hostname for Keycloak

Configuring a database

Enabling clustering

Configuring a reverse proxy

Testing your environment

Further reading

Managing Users

Technical requirements

Managing local users

Integrating with LDAP and Active Directory

Integrating with third-party identity providers

Integrating with social identity providers

Allowing users to manage their data

Further reading

Authenticating Users

Authenticating Users

Technical requirements

Understanding authentication flows

Using passwords

Using Web Authentication (WebAuthn)

Using strong authentication

Further reading

Managing Tokens and Sessions

Managing Tokens and Sessions

Technical requirements

Managing sessions

Managing tokens

Further reading

Extending Keycloak

Extending Keycloak

Technical requirements

Understanding service provider interfaces

Changing the look and feel

Customizing authentication flows

Looking at other customization points

Further reading

Securing Keycloak and Applications

Securing Keycloak and Applications

Securing Keycloak

Securing cluster communication

Securing user accounts

Securing applications

Further reading

Assessments

Other Books You May Enjoy

Other Books You May Enjoy

Index

Customer Reviews

4.8 (5)

5 star

80%

4 star

20%

3 star

0

2 star

0

1 star

0

Chapter 8

When you put data into tokens, they actually grow disproportionately in size. One option to help here is to include only the minimum information that your application needs and, for additional information, to use the token introspection endpoint. The drawback is that your application will need an additional request to Keycloak when serving requests. You should also consider disabling the Full Scope Allowed setting in your client settings, so that only information relevant to your client is included in tokens.
Realm roles should be used to represent the user’s role within an organization. These roles have the same semantics regardless of the clients created in a realm. On the other hand, the semantics for a client role are specific to the client they belong to. In this chapter, we created a realm role and a client role using the same name: manager. While the realm role could represent users with the role of manager in an organization, the manager...