Master Keycloak with SpringBoot: Secure Java Apps Like a Pro

Discover why Keycloak is essential for securing Java apps, offering identity and access management, single sign-on, and federation with LDAP, Active Directory, Google, and SAML, plus JWT-based token authentication.

Keycloak acts as a security butler for your apps, handling authentication and authorization with ready made login pages, single sign on, MFA, and OAuth two, OpenID connect, and Saml.

See how real-world organizations like Red Hat, Siemens, CERN, European Union institutions, and Novartis deploy Keycloak for free, open source sso, mfa, oauth2, admin console, and scalable microservices.

Keycloak enables enterprise authentication by issuing a JWT-like token to your app, enabling federation with external identity providers like Google, Microsoft, or LDAP for single sign-on.

Download Keycloak from the official website and run it from the bin folder. Start in development mode, create an admin user, and access admin console to manage realms and users.

Install and configure OpenJDK on Mac or Windows, choose the correct version (21 or 22), move the JDK to the proper system folder, and verify with java -version.

Install Keycloak by running the bin casey.sh script in the Keycloak folder and start dev. It runs on localhost:8080, completing the installation for the next lecture.

Create a temporary admin user with the password admin, sign in to the Keycloak administration console, and explore the dashboard to see how admin access works.

Explore the Keycloak dashboard, manage realms, clients, and users, and configure authentication options, identity providers, and user federation with LDAP or AD.

Create a realm named Coding Center, then configure a Spring Boot app as a Keycloak client with OpenID Connect, enabling redirect-based authentication and authorization code flow.

Create realm roles and users in Keycloak, assign employee and manager roles, set passwords, and verify mappings to prepare a Spring Boot security setup.

Configure the keycloak configuration file for production, moving from development mode to a production-ready server and opting for Postgre or other databases.

PostgreSQL offers production-ready reliability for Keycloak deployments, with backups, restores, monitoring, tuning options, and remote access. S2 is quick to start but not ideal for long-term production.

Download PostgreSQL from the official site for your OS, install with PgAdmin 4 to view database structures, and prepare for configuring it with Keycloak.

Open pgAdmin 4, navigate databases and schemas, and create a new PostgreSQL database named Keycloak to prepare for persisting Keycloak data in a later step.

Configure Keycloak to use PostgreSQL by editing the vendor settings, JDBC URL, and credentials; enable http/https in production, and verify persistence with PostgreSQL tables and user data.

Explore realm settings and OpenID endpoint configuration, including token, authorization, introspection, end session, and user info endpoints, and verify them with Postman to see Keycloak's OpenID integration.

Learn to test Keycloak OpenID token retrieval with Postman by configuring a Spring Boot Keycloak demo collection and using password grant to obtain access and refresh tokens.

Explore how access tokens and refresh tokens work with Keycloak: short lived access tokens, long lived refresh tokens, and how refresh tokens renew access without re-authentication for seamless background sessions.

Post a logout request to the session token endpoint at the Keycloak realm using the refresh token, client ID, client secret, and a bearer access token.

Validate logout in Keycloak by sending a post request with a refresh token, access token, and client credentials to confirm session invalidation and token expiry.

Enable guest login to Keycloak by posting to the login endpoint with basic auth using the client id and client secret, requesting client credentials for an access token.

Generate a Spring Boot project via Spring Initializr with Maven, Java 21, including Spring Web and Spring Security, then set up a resource server to validate JWTs.

Configure Spring Boot to connect to Keycloak via application.properties (or yaml), setting oauth2 client details (id, secret, scope), authorization code flow, redirect URI, and resource server jwt validation.

Implement a JWT converter in spring security to extract realm access roles from Keycloak tokens and convert them to granted authorities, handle nulls, and prefix roles with role_.

Configure a Spring security class to enable web and method security, wire a JWT converter, and enforce manager and employee roles on protected endpoints while permitting public APIs via Keycloak.

Create a rest controller with a common api/v1 prefix, exposing public and role-restricted endpoints for employee and manager, using pre-authorized tokens, and preparing for postman demonstrations.

Validate end-to-end access control using postman to test role-based mappings with bearer tokens, observe 200, 403, and 404 responses, and plan to reuse tokens with variables.

Set up access token and refresh token variables in a Spring Boot Keycloak environment using Postman scripts. Extract tokens from login responses and reuse them across requests.

Celebrate completing the course and adding a new skill to your portfolio, resume, or LinkedIn profile. Explore more courses and the instructor's YouTube channel to keep learning.