Book Image

Keycloak - Identity and Access Management for Modern Applications - Second Edition

By : Stian Thorgersen, Pedro Igor Silva

4.8 (5)

Book Image

Keycloak - Identity and Access Management for Modern Applications - Second Edition

4.8 (5)

By: Stian Thorgersen, Pedro Igor Silva

Overview of this book

The second edition of Keycloak - Identity and Access Management for Modern Applications is an updated, comprehensive introduction to Keycloak and its updates. In this new edition, you will learn how to use the latest distribution of Keycloak. The recent versions of Keycloak are now based on Quarkus, which brings a new and improved user experience and a new admin console with a higher focus on usability. You will see how to leverage Spring Security, instead of the Keycloak Spring adapter while using Keycloak 22. As you progress, you’ll understand the new Keycloak distribution and explore best practices in using OAuth. Finally, you'll cover general best practices and other information on how to protect your applications. By the end of this new edition, you’ll have learned how to install and manage the latest version of Keycloak to secure new and existing applications using the latest features.

Preface

Who this book is for

What this book covers

To get the most out of this book

Getting Started with Keycloak

Getting Started with Keycloak

Technical requirements

Introducing Keycloak

Installing and running Keycloak

Discovering the Keycloak admin and account consoles

Free Chapter

Securing Your First Application

Securing Your First Application

Technical requirements

Understanding the sample application

Running the application

Understanding how to log in to the application

Securely invoking the backend REST API

Brief Introduction to Standards

Brief Introduction to Standards

Authorizing application access with OAuth 2.0

Authenticating users with OpenID Connect

Leveraging JWT for tokens

Understanding why SAML 2.0 is still relevant

Authenticating Users with OpenID Connect

Authenticating Users with OpenID Connect

Technical requirements

Running the OpenID Connect playground

Understanding the Discovery endpoint

Authenticating a user

Understanding the ID token

Invoking the UserInfo endpoint

Dealing with users logging out

Further reading

Authorizing Access with OAuth 2.0

Authorizing Access with OAuth 2.0

Technical requirements

Running the OAuth 2.0 playground

Obtaining an access token

Requiring user consent

Limiting the access granted to access tokens

Validating access tokens

Further reading

Securing Different Application Types

Securing Different Application Types

Technical requirements

Understanding internal and external applications

Securing web applications

Securing native and mobile applications

Securing REST APIs and services

Further reading

Integrating Applications with Keycloak

Integrating Applications with Keycloak

Technical requirements

Choosing an integration architecture

Choosing an integration option

Integrating with Golang applications

Integrating with Java applications

Integrating with JavaScript applications

Integrating with Node.js applications

Using a reverse proxy

Try not to implement your own integration

Further reading

Authorization Strategies

Authorization Strategies

Understanding authorization

Using OAuth2 scopes

Using Keycloak as a centralized authorization server

Further reading

Configuring Keycloak for Production

Configuring Keycloak for Production

Technical requirements

Setting the hostname for Keycloak

Configuring a database

Enabling clustering

Configuring a reverse proxy

Testing your environment

Further reading

Managing Users

Technical requirements

Managing local users

Integrating with LDAP and Active Directory

Integrating with third-party identity providers

Integrating with social identity providers

Allowing users to manage their data

Further reading

Authenticating Users

Authenticating Users

Technical requirements

Understanding authentication flows

Using passwords

Using Web Authentication (WebAuthn)

Using strong authentication

Further reading

Managing Tokens and Sessions

Managing Tokens and Sessions

Technical requirements

Managing sessions

Managing tokens

Further reading

Extending Keycloak

Extending Keycloak

Technical requirements

Understanding service provider interfaces

Changing the look and feel

Customizing authentication flows

Looking at other customization points

Further reading

Securing Keycloak and Applications

Securing Keycloak and Applications

Securing Keycloak

Securing cluster communication

Securing user accounts

Securing applications

Further reading

Assessments

Other Books You May Enjoy

Other Books You May Enjoy

Index

Customer Reviews

4.8 (5)

5 star

80%

4 star

20%

3 star

0

2 star

0

1 star

0

Chapter 12

Most of the time, sessions – both user and client – are not stored in the database. As you learnt from Chapter 9, Configuring Keycloak for Production, sessions are stored in-memory and shared across the different cluster nodes. However, there is a specific type of session called an offline session that is stored in the database. For more details about offline sessions, look at the documentation at https://www.keycloak.org/docs/latest/server_admin/#_offline-access.
User sessions hold state about the authenticated user, regardless of the client. On the other hand, client sessions are bound to the client the user authenticated with and they hold the state about the user within the context of a specific client.
Keycloak provides different ways for revoking tokens and expiring sessions. As you learnt from this chapter, tokens can be revoked by invoking the revocation endpoint and the sessions can be destroyed through the administration console...