Keycloak : Single Sign On with Spring Boot & Spring Security

Install JDK 8, Apache Maven, and Spring Tool Suite (STS), then configure Javahome and M2 home environment variables and update your path for a ready local spring boot development environment.

Download and install the MySQL server and workbench, start the local MySQL server, test the connection to localhost:3306, and prepare a schema for microservices.

Explain authentication and authorization with real-world examples; authenticate users to prove identity, then authorize access based on roles such as student or professor.

Understand how single sign on (SSO) authenticates once to access multiple applications within one organization in the same browser session, illustrated by Google services like Gmail, YouTube, and Drive.

Discover how Keycloak enables single sign-on across multiple Spring Boot apps by centralizing authentication on a Keycloak server, with a Spring Boot adapter for Spring Security.

Download the Keycloak standalone server from keycloak.org, choose zip or tar for your operating system, and extract it to a local location; the latest version may vary.

Explore the basics of Spring Security and Thymeleaf, essential for this course. Understand how Spring Security enables authentication and authorization, while Thymeleaf renders HTML templates in Spring Boot.

Set up a Spring Boot application with Maven, add web, Spring Data JPA, MySQL driver, Spring Security, and Thymeleaf dependencies, and configure component, entity scans, and JPA repositories.

Define and map a user and roles schema in MySQL using Spring Data JPA, creating user and roles entities and repositories to implement a one-to-many relationship.

Run the Spring Boot app to see Spring Security's default login page, then customize with your own login.html under templates and a controller mapping for / and /login with Thymeleaf.

Configure spring security: enable web security, define public urls, authenticate others, disable csrf, and set up form login at /login with a default success url using username and password parameters.

Implement a custom user details service to fetch a user by username from the database, convert roles to granted authorities, and supply Spring Security with username, password, and authorities.

Learn to secure user passwords in spring security by encoding plain text passwords with bcrypt and preventing plain-text storage in your setup.

Map the user home page at /home, reuse the login HTML, and display the logged-in username in thymeleaf using the spring expression language and the authentication object.

Demonstrates spring security form-based login with bcrypt encoding, a login page at /login, and two users, John (student) and Sachin (professor), authenticated via thymeleaf.

Enable authorization in Spring Security by using @PreAuthorize with hasAuthority('professor') on the manage students page, and activate global method security with prePostEnabled = true.

Configure a custom access denied page in Spring Security to handle 403 errors, map a dedicated HTML view at /access-denied, and display a clear permission message for non-professor users.

Enable logout with spring security by configuring a logout URL and a logout success URL that redirects to the login page, with a header logout hyperlink handled by spring security.

Explain why we need Keycloak by outlining the problem of separate logins across two applications and fragmented sessions, and how single sign-on with Keycloak resolves it.

Run the Keycloak server, observe the default 8080 port, and prepare to switch from embedded H2 to MySQL for centralized login and user management in a spring boot SSO setup.

Create a separate MySQL schema named Keycloak to store Keycloak data, and configure it in upcoming lessons, avoiding user detail storage in the existing tables.

Download the MySQL Connector/J jar and verify version compatibility with your local MySQL. Create a com.mysql module and module.xml in Keycloak to enable the database connection.

Configure Keycloak to use MySQL as the data source by editing standalone.xml data source and driver settings, using the MySQL module and connector.

Configure Keycloak with a MySQL database, understand automatic table creation, and manage configuration through the Keycloak UI, then access the admin console at localhost:8080.

Change the Keycloak server port and avoid conflicts by running the student and professor apps on 8081 and 8082 for seamless single sign-on with Spring Boot.

Create an admin user on a local Keycloak server, log into the admin console to manage users, roles, clients, and sessions, and prepare for single sign-on with Spring Boot.

Learn how realms centralize users and roles in Keycloak and how applications become clients by obtaining a client ID and client secret.

Create a realm, then add two clients (student app and professor app) with confidential access, configure redirect URIs to localhost:8081 and 8082, and manage client secrets for spring boot integration.

Create John and Sachin users in Keycloak, set temporary passwords as admin, and require a password change on first login; next lecture covers assigning roles.

Create student and professor roles in Keycloak, assign them to John and Sachin via role mappings, and verify role membership across the realm with two clients.

Configure Keycloak with spring boot by adding the Keycloak spring boot starter and configuring auth url, realm, client id, and client secret in the student application.

Configure Keycloak with Spring Security by implementing a Keycloak web security config, using Spring Boot config resolver for properties, and using Keycloak as the authentication provider.

Demonstrates authenticating a Spring Boot student application with Keycloak by redirecting users to login, handling first login password changes, and displaying preferred_username while enforcing professor role access.

Configure the professor app with the same Keycloak setup as the student app, adding dependencies, properties, and security config to enable single sign-on testing.

Demonstrate single sign-on with Keycloak across student and professor apps, showing how authentication redirects, sessions persist in the same browser, and seamless access to both applications.

Celebrate completing the keycloak single sign on with spring boot and spring security course, share feedback, and ask questions on the question and answer board as you continue to learn.