Spring Boot With Keycloak-Integration

This project secures a Spring Boot application using Keycloak, an open-source Identity and Access Management tool.

Prerequisites

Java 17+
Maven
Keycloak Server 21+

Getting Started

Follow these steps to set up the project on your local machine for development and testing.

Installation

Clone the repository:

git clone https://github.com/chirag-rathod-dev/Keycloak-Integration-with-Spring-Boot-3.git

Navigate into the project directory:
```
cd your-repository-name
```
Use Maven to build the project:
```
mvn clean install
```
You can then run the Spring Boot application using:
```
mvn spring-boot:run
```

Keycloak Setup

Get started with Keycloak on Docker

https://www.keycloak.org/getting-started/getting-started-docker

Create a realm

A realm in Keycloak is equivalent to a tenant. Each realm allows an administrator to create isolated groups of applications and users. Initially, Keycloak includes a single realm, called master. Use this realm only for managing Keycloak and not for managing any applications.

Use these steps to create the first realm.
Open the Keycloak Admin Console.
Click Keycloak next to master realm, then click Create Realm.
Enter myrealm in the Realm name field.
Click Create.

Create a client

Use these steps to create a client:

Verify that you are still in the myrealm realm, which is shown above the word Manage.
Click Clients in the left-hand menu.
Click Create new client.
Fill in the form with the following values:
- Client ID: rest-api
- Client Protocol: openid-connect
- Client Type: Confidential
- Access Type: Public
Login Setting
- root URL: http://localhost:8081
- Home URL: http://localhost:8081
- Valid Redirect URIs: http://localhost:8081/*
- Valid Post Logout Redirect URIs: http://localhost:8081
- Web Origins: *
Click Save.

Create a realms role

Use these steps to create a role:

Verify that you are still in the myrealm realm, which is shown above the word Manage.
Click Roles in the left-hand menu.
Click Create new role.
Fill in the form with the following values:
- Role Name: user
- Description: User Role
- Role Name: admin
- Description: Admin Role
Click Save.

Create a user

Initially, the realm has no users. Use these steps to create a user:

Verify that you are still in the myrealm realm, which is shown above the word Manage.
Click Users in the left-hand menu.
Click Create new user.
Fill in the form with the following values:
- Email Verified: On
- Username: myuser
- Email: any email
- First name: any first name
- Last name: any last name
Click Create.
Click the Credentials tab.
Fill in the form with the following values:
- Password: mypassword
- Password Confirmation: mypassword
- Temporary: Off
Click Save.
Click the Role Mappings tab.
Select the role you want to assign to the user. Before this step, you need to create a client role & assign the role to the client.
Click Add.

Create a client role

Use these steps to create a client role:

Verify that you are still in the myrealm realm, which is shown above the word Manage.
Click Client Roles in the left-hand menu.
Click Create new client role.
Fill in the form with the following values:
- Name: client_user
- Description: Client User
- Name: client_admin
- Description: Client Admin
Click Create.

Assign Assosiate the role to the client

Use these steps to assign the role to the client:

Verify that you are still in the myrealm realm, which is shown above the word Manage.
Click Realms Roles in the left-hand menu.
Click on Role Name (e.g. user) in the list of roles.
Open Associated Roles tab.
Select the client you want to assign the role to.
Select the role you want to assign to the client. e.g client_user or client_admin
Click Add.

Get the OpenID Configuration

http://localhost:8080/realms/myrealm/.well-known/openid-configuration

Get the Access Token

http://localhost:8080/realms/myrealm/protocol/openid-connect/token Body (x-www-form-urlencoded)

{
    "client_id": "rest-api",
    "client_secret": "client-secret",
    "grant_type": "password",
    "username": "myuser",
    "password": "mypassword"
}

}

Get the User Info

http://localhost:8080/realms/myrealm/protocol/openid-connect/userinfo Authorization: Bearer <access_token>

If you are getting the error Forbidden 403, You need to add client scopes.

Open Client Scopes in the left-hand menu.
Click on the client scope (e.g. openid).
Click save.
Open clients in the left-hand menu then client (e.g. rest-api).
Click on the client scope and add the client scope (e.g. openid) to the client.
Make sure openid is default client scope.
Click save.
Try to get the user info again.

Test the API

Open Postman.
Create a new request.
Set the request method to POST.
Set the URL to http://localhost:8081/api/v1/admin.
Set the Authorization header to Bearer <access_token>.
Send the request.
You should get a response with the message "Hello World!". If you get a 403 Forbidden error, you need to add client scopes.
If you get a 401 Unauthorized error, you need to check the access token.
If you get a 500 Internal Server Error, you need to check the server logs.
If you get a 200 OK response with the message "Hello World!", you have successfully secured the API using Keycloak.

You can also test the API using the curl command:

curl -X POST http://localhost:8081//api/v1/admin -H "Authorization: Bearer <access_token>"

You should get a response with the message "Hello World!".

You have to add one more user for client_user role. PreAuthorize("hasRole('client_user')") is used in the controller.

Conclusion

Congratulations! You have successfully secured a Spring Boot application using Keycloak. You can now use Keycloak to manage users, roles, and permissions for your application.