Book Image

Keycloak - Identity and Access Management for Modern Applications - Second Edition

By : Stian Thorgersen, Pedro Igor Silva
4.8 (5)
Book Image

Keycloak - Identity and Access Management for Modern Applications - Second Edition

4.8 (5)
By: Stian Thorgersen, Pedro Igor Silva

Overview of this book

The second edition of Keycloak - Identity and Access Management for Modern Applications is an updated, comprehensive introduction to Keycloak and its updates. In this new edition, you will learn how to use the latest distribution of Keycloak. The recent versions of Keycloak are now based on Quarkus, which brings a new and improved user experience and a new admin console with a higher focus on usability. You will see how to leverage Spring Security, instead of the Keycloak Spring adapter while using Keycloak 22. As you progress, you’ll understand the new Keycloak distribution and explore best practices in using OAuth. Finally, you'll cover general best practices and other information on how to protect your applications. By the end of this new edition, you’ll have learned how to install and manage the latest version of Keycloak to secure new and existing applications using the latest features.

Related Content you might be interested in

Current Title:

Small book image
Keycloak - Identity and Access Management for Modern Applications - Second Edition
Stian Thorgersen | Pedro Igor Silva
Jul, 2023 | 350 pages
Small book image
Cloud Identity Patterns and Strategies
Giuseppe Di Federico | Fabrizio Barcaroli
Dec, 2022 | 258 pages
Small book image
Azure Active Directory for Secure Application Development
Sjoukje Zaal
May, 2022 | 268 pages
Small book image
Implementing Multifactor Authentication
Marco Fanti
Jun, 2023 | 550 pages
Table of Contents (18 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
1
Getting Started with Keycloak
Getting Started with Keycloak
Technical requirements
Introducing Keycloak
Installing and running Keycloak
Discovering the Keycloak admin and account consoles
Summary
Questions
Free Chapter
2
Securing Your First Application
Securing Your First Application
Technical requirements
Understanding the sample application
Running the application
Understanding how to log in to the application
Securely invoking the backend REST API
Summary
Questions
3
Brief Introduction to Standards
Brief Introduction to Standards
Authorizing application access with OAuth 2.0
Authenticating users with OpenID Connect
Leveraging JWT for tokens
Understanding why SAML 2.0 is still relevant
Summary
Questions
4
Authenticating Users with OpenID Connect
Authenticating Users with OpenID Connect
Technical requirements
Running the OpenID Connect playground
Understanding the Discovery endpoint
Authenticating a user
Understanding the ID token
Invoking the UserInfo endpoint
Dealing with users logging out
Summary
Questions
Further reading
5
Authorizing Access with OAuth 2.0
Authorizing Access with OAuth 2.0
Technical requirements
Running the OAuth 2.0 playground
Obtaining an access token
Requiring user consent
Limiting the access granted to access tokens
Validating access tokens
Summary
Questions
Further reading
6
Securing Different Application Types
Securing Different Application Types
Technical requirements
Understanding internal and external applications
Securing web applications
Securing native and mobile applications
Securing REST APIs and services
Summary
Questions
Further reading
7
Integrating Applications with Keycloak
Integrating Applications with Keycloak
Technical requirements
Choosing an integration architecture
Choosing an integration option
Integrating with Golang applications
Integrating with Java applications
Integrating with JavaScript applications
Integrating with Node.js applications
Using a reverse proxy
Try not to implement your own integration
Summary
Questions
Further reading
8
Authorization Strategies
Authorization Strategies
Understanding authorization
Using RBAC
Using GBAC
Using OAuth2 scopes
Using ABAC
Using Keycloak as a centralized authorization server
Summary
Questions
Further reading
9
Configuring Keycloak for Production
Configuring Keycloak for Production
Technical requirements
Setting the hostname for Keycloak
Enabling TLS
Configuring a database
Enabling clustering
Configuring a reverse proxy
Testing your environment
Summary
Questions
Further reading
10
Managing Users
Managing Users
Technical requirements
Managing local users
Integrating with LDAP and Active Directory
Integrating with third-party identity providers
Integrating with social identity providers
Allowing users to manage their data
Summary
Questions
Further reading
11
Authenticating Users
Authenticating Users
Technical requirements
Understanding authentication flows
Using passwords
Using OTPs
Using Web Authentication (WebAuthn)
Using strong authentication
Summary
Questions
Further reading
12
Managing Tokens and Sessions
Managing Tokens and Sessions
Technical requirements
Managing sessions
Managing tokens
Summary
Questions
Further reading
13
Extending Keycloak
Extending Keycloak
Technical requirements
Understanding service provider interfaces
Changing the look and feel
Customizing authentication flows
Looking at other customization points
Summary
Questions
Further reading
14
Securing Keycloak and Applications
Securing Keycloak and Applications
Securing Keycloak
Securing cluster communication
Securing user accounts
Securing applications
Summary
Questions
Further reading
15
Assessments
Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Chapter 6
Chapter 7
Chapter 8
Chapter 9
Chapter 10
Chapter 11
Chapter 12
Chapter 13
Chapter 14
16
Other Books You May Enjoy
Other Books You May Enjoy
17
Index
Index

Preface

Keycloak is an open source Identity and Access Management (IAM) tool with a focus on modern applications such as single-page applications, mobile applications, and REST APIs. Since the first edition of this book was published there have been some big changes to Keycloak.

The Keycloak administration console has received a full make-over with a bigger focus on usability and accessibility requirements.

This distribution of Keycloak is now based on Quarkus rather than the WildFly application server. This brings a new, and much improved, way to configure and deploy Keycloak to different computing environments – from on-premises infrastructure to public and hybrid clouds.

Some of the Keycloak Adapters have been deprecated, and instead Keycloak is now focusing on selecting quality libraries from existing communities; like leveraging built-in support for OpenID Connect and OAuth 2.0 from whatever language or framework your application is using.

The project was started in 2014 with a strong focus on making it easier for developers to secure their applications. It has since grown into a well-established open source project with a strong community and user base. It is used in production for scenarios ranging from small websites with only a handful of users, up to large enterprises with millions of users.

This book introduces you to Keycloak, covering how to install Keycloak as well as how to configure it ready for production use cases. Furthermore, this book covers how to secure your own applications, as well as providing a good foundation for understanding OAuth 2.0 and OpenID Connect.

In this edition, there are updated chapters based on the latest release of Keycloak. If you are familiar with the content from the previous edition, this edition will give you relevant updates throughout to bring you up to speed with the latest release. For the newcomers, this edition will serve as an excellent first step towards understanding Keycloak and how it can help you to enable a rich IAM solution within your organization.

Previous Section
Next Section