Advanced OpenID Connect with Keycloak and Spring Security

Explore the fundamentals of OAuth and OpenID Connect, identify major actors and flows, key tokens like access and refresh tokens, scopes, and roles with Keycloak in social and enterprise contexts.

Explore why OAuth 2.0 exists for secure, user-consented access to resources. See how the authorization server issues a short-lived access token, the bearer token, to the client for Google Photos.

Learn how clients and scopes govern access in OAuth and OpenID Connect, using endpoints from the well-known configuration and client registration to obtain tokens for protected resource servers.

Learn the difference between opaque and structured access tokens, including JWTs, how they are signed and verified, and how resource servers use introspection and the Json web key set endpoint.

Explore end-to-end oauth flow, focusing on the authorization code grant, exchanging authorization codes for access tokens, using refresh tokens, OpenID scopes, ID tokens, and the userinfo endpoint, with security considerations.

Learn why the implicit grant is deprecated and how pixie strengthens the authorization code flow for public clients by using code verifier and code challenge (sha256, base64 URL encoding).

Explore how client credentials grant lets a client obtain an access token for itself to access resources, and why the password grant is deprecated in OAuth 2.1, authorization code flow.

OpenID Connect extends OAuth 2.0 with scopes such as OpenID, profile, and email to authenticate users and access id tokens and user info in apps using Keycloak and Spring Boot.

Explore how enterprise apps use OpenID Connect with Keycloak to embed roles in tokens for internal authorization, and verify tokens locally in microservices using authorization code and client credentials grants.

Demonstrates a bug tracker app secured by Keycloak, using the authorization code flow to obtain access, ID, and refresh tokens, while creating, editing, and deleting bugs and managing projects.

Configure Keycloak for the bug tracker by defining users, a bug tracker scope, and a bug tracker client with login and logout redirects, using the authorization code flow.

Explore the bug tracker design built as a monolithic spring boot app, with an in-memory bug tracker service, an MVC UI using thymeleaf and bootstrap, and OpenID Connect security.

Build a bug tracker service in Spring Boot with OAuth2 client and OpenID Connect, using in-memory storage, bean validation, Thymeleaf, and deriving the submitter from the OIDC token.

Secure the bug tracker as an OpenID Connect client with Keycloak, using Spring Security and the OAuth client library, configuring client registration, issuer, and OIDC logout.

Explore how the bug tracker ui controller ties spring security and oauth tokens to the UI, using get/post mappings and the Time Leaf template engine to render authenticated user data.

Run the app with Keycloak OpenID configuration, perform the authorization code flow, exchange the code for tokens, validate state and nonce, and map scopes to Spring Security authorities.

Learn how to enable PKCE for both public and confidential clients in a Keycloak and Spring Boot setup, including enabling consent and validating code verifier transmission.

Map BugTracker scopes to roles in Keycloak, assign them to users, and enforce Spring Security restrictions to enable scope-based authorization.

Explore a hands-on Spring Boot project implementing OpenID Connect with Keycloak, featuring regular and administrator roles, social logins (Google, GitLab), and bulk import from GitLab via OAuth and SAML.

Explore an end-to-end OpenID Connect integration with Keycloak and Spring Security detailing realms, scopes, roles (jobs-user, jobs-admin), a client, PKCE, and protected UI access.

Explore using roles for authorization and including them in access and ID tokens in Spring Boot OAuth apps, compare Keycloak with Okta, and study multi-provider setups using Keycloak and GitLab.

Move authorization from scopes to roles by configuring a Keycloak mapper that adds a client roles claim for bugtracker, producing multi-valued roles in access and id tokens.

Map Keycloak roles to Spring Boot authorities by customizing the user info endpoint, enabling role-based access with role_ prefixes for a bug tracker app.

Configure Keycloak OIDC to include roles in tokens and map them to Spring Boot authorities, then verify access by logging in as admin and user in the jobs app.

Learn to configure a Spring Boot app for multiple identity providers using OpenID Connect with Keycloak and GitLab, including dual clients and GitLab application registration.

Register a GitLab account, create an application as an OAuth client, and configure Spring Boot with GitLab as an OpenID Connect provider, setting issuer, client ID, and client secret.

Configure Spring Security to support multiple identity providers by wiring Keycloak and GitLab in application.properties, enabling an OpenID Connect authorization code flow with dual login links.

configure custom authorities for social logins by adding a static social providers list and an isSocial check; map any social login to the role bugtracker.user in mapped authorities.

Identify the drawbacks of handling multiple identity providers, such as Keycloak and GitLab, in a Spring Boot app, including claim translations, distributed user stores, and token verification across microservices.

Transform a monolith bug tracker into a UI app and microservice while applying common OpenID Connect grant types, roles in access tokens, and Keycloak client credentials setup for enterprises.

Split the bug tracker into a user interface and a resource server, securing the API with OAuth and OpenID Connect using Keycloak and JWT verification on port 8081.

Demonstrate calling the bug tracker API from the UI using a Rest client and OAuth 2 authorized client, with bearer tokens and token refresh for secure microservices.

Explore handling multiple identity providers, such as Keycloak and GitLab, and how access tokens, JWTs, and public-key verification affect microservice security.

Explore using the client credentials grant with Keycloak for enterprise schedulers, implementing a Spring Boot bug statistics scheduler that calls the bug tracker API and prints results to the console.

Create a bug tracker stats client with client credentials grant, assign the bug tracker dot user role, and map roles into tokens using scope mapper, while disabling full scope.

Add a statistics endpoint and a scheduler using client credentials with Keycloak to fetch bug statistics and token, exposing open and closed bug counts, with clustering notes and Shedlock.

Discover how identity brokering with Keycloak centralizes external IDPs, enabling apps to authenticate via OpenID Connect or SAML across social logins, partnerships, and cloud deployments.

Illustrates the identity broker http message flow among the user, the app, Keycloak, and an idp, highlighting OAuth authorization, token exchange, and OpenID Connect versus Saml protocol conversion.

Set up a GitLab identity provider in Keycloak by configuring client ID and secret, redirect URI, and sync mode; then register the redirect URI in GitLab and grant read user.

Configure a single idp in spring boot by commenting out GitLab properties, integrate GitLab with Keycloak. Map bug tracker user role via a mapper and rely on next login provisioning.

Enable Keycloak to act as a SAML service provider, integrating with an external SAML IDP through trusted metadata. Map SAML roles to bug tracker access for enterprise users.

Configure the bug tracker to support saml single sign-on for enterprise users via Okta, mapping bug tracker groups to Keycloak roles during provisioning.

Learn to configure a SAML 2.0 identity provider in Keycloak using Okta metadata, map bug tracker groups to roles, and test login flows for a Bug Tracker application.

Enable signed Saml requests and assertions, configure certificates and single logout between Keycloak and Okta, and test global logout across applications.

Enable SAML assertion encryption in Keycloak and Okta, generating an encryption certificate and updating SAML metadata. Verify the encrypted assertion using SAML tools and a test login flow.

Automate user attribute provisioning from Okta to Keycloak using SAML attribute mappers for first name, last name, and email, enabling dynamic provisioning and seamless OpenID Connect integration.

Learn how to handle multiple authorization servers at once by integrating Keycloak for OpenID Connect login with GitLab for OAuth, enabling cross-provider access to resources in the bug tracker.

Configure Spring Security for OAuth with Keycloak to access GitLab projects via an authorization code flow, disabling GitLab login and using the authorize endpoint with API and read API scopes.

Access the bug tracker app to demonstrate logging in with Keycloak and accessing GitLab APIs via OAuth and authorization code flow, emphasizing OpenID scope.

Replace the default login page with a custom login page that redirects to Keycloak OIDC, configure the /login and /logout endpoints, and validate the OAuth 2.0 OpenID Connect flow.

Explore encoding and cryptography basics, including url encoding, base64 encoding, hashing, encryption, and digital signatures, with a focus on their role in authentication systems like SAML and OAuth.

Learn how URL encoding encodes parameter values for HTTP get and post requests, encoding spaces and characters like ? and = so data travels safely.

Explore cryptographic hashing, converting any data into a fixed-size hash or digest. Learn how hashes are unique, non-reversible, and used for password storage with salt, data integrity, and tamper detection.

Explore symmetric encryption, using a secret key and a known algorithm to transform data into cipher data and back through decryption, while noting the key distribution challenge.

Understand how asymmetric encryption uses RSA key pairs to securely exchange data, with private keys kept by owners and public keys distributed via X509 certificates issued by certificate authorities.

Explain hybrid encryption: RSA cannot encrypt large data, so encrypt data with AES-256 and protect the AES key by RSA encryption of the random secret key, enabling secure key exchange.

Using RSA, Alice signs the sha-256 data hash with her private key, and Bob verifies with Alice's public key to confirm the sender.

Demonstrates base64 encoding and decoding, URL encoding, and hashing with OpenSSL dgst, highlighting salted password hashes and defenses against dictionary attacks.

Demonstrate symmetric encryption with openssl enc, derive a secret key via pbkdf2 and a digest, encrypt and decrypt lines or files, and encode output with base64 and url encoding.

Explore asymmetric encryption with RSA using OpenSSL: generate private and public keys, create a self-signed certificate, sign with sha-256, and encrypt/decrypt data between Alice and Bob.

Demonstrates hybrid encryption by creating a random 245-byte passphrase with openssl, encrypting large data with AES-256, and securing the passphrase with RSA encryption.

Demonstrates digitally signing data with rsa via openssl by hashing with sha512, signing the digest with a private key, base64 encoding, and verifying the signature with a public key.

Understand background topics essential for the course, including Java records, nested classes, and thread locals in Spring Boot, to access user security information across threads.

Distinguish enterprise authorization from OAuth authorization and show how authentication verifies users while OAuth prompts consent to access the LinkedIn API.

Differentiate OAuth 2.0 and OpenID Connect by showing when to use access tokens versus ID tokens, and explain OpenID scopes like OpenID, profile, and email for user authentication.

Explore static versus non-static nested classes in Java, showing how inner classes access the parent’s members, and when to choose static nesting for encapsulation and efficiency.

Explore how Java records model immutable data and auto-generate getters, equals, hashCode, and toString, with canonical and non-canonical constructors and defensive copies for mutable fields.

Explore how thread locals provide per-thread visibility for variables in Java using ThreadLocal, with set, get, and remove operations, and see initialization via a supplier and thread maps.

Explore inheritable thread locals, how they copy values to child threads, and the synchronization implications of shared objects. Learn how to override child value for thread-safe behavior.

Identify the downsides of Java thread locals, including unconstrained mutability and memory leaks from forgotten remove calls, and compare platform versus virtual threads and inheritance concerns.

Spring Boot propagates the user security context from the handling thread to async tasks using a delegating security context async task executor. This enables access to authentication in async methods.