Keycloak - Identity and Access Management for Modern Applications

Keycloak - Identity and Access Management for Modern Applications

by Stian Thorgersen, Pedro Igor Silva
Released June 2021
Publisher(s): Packt Publishing
ISBN: 9781800562493

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Learn to leverage the advanced capabilities of Keycloak, an open-source identity and access management solution, to enable authentication and authorization in applications

Key Features

  • Get up to speed with Keycloak, OAuth 2.0, and OpenID Connect using practical examples
  • Configure, manage, and extend Keycloak for optimized security
  • Leverage Keycloak features to secure different application types

Book Description

Implementing authentication and authorization for applications can be a daunting experience, often leaving them exposed to security vulnerabilities. Keycloak is an open-source solution for identity management and access management for modern applications, which can make a world of difference if you learn how to use it.

Keycloak, helping you get started with using it and securing your applications. Complete with hands-on tutorials, best practices, and self-assessment questions, this easy-to-follow guide will show you how to secure a sample application and then move on to securing different application types. As you progress, you will understand how to configure and manage Keycloak as well as how to leverage some of its more advanced capabilities. Finally, you'll gain insights into securely using Keycloak in production.

By the end of this book, you will have learned how to install and manage Keycloak as well as how to secure new and existing applications.

What you will learn

  • Understand how to install, configure, and manage Keycloak
  • Secure your new and existing applications with Keycloak
  • Gain a basic understanding of OAuth 2.0 and OpenID Connect
  • Understand how to configure Keycloak to make it ready for production use
  • Discover how to leverage additional features and how to customize Keycloak to fit your needs
  • Get to grips with securing Keycloak servers and protecting applications

Who this book is for

Developers, sysadmins, security engineers, or anyone who wants to leverage Keycloak and its capabilities for application security will find this book useful. Beginner-level knowledge of app development and authentication and authorization is expected.

Table of contents

  1. Keycloak - Identity and Access Management for Modern Applications
  2. Contributors
  3. About the authors
  4. About the reviewers
  5. Preface
    1. Who this book is for
    2. What this book covers
    3. To get the most out of this book
    4. Download the example code files
    5. Code in Action
    6. Download the color images
    7. Conventions used
    8. Get in touch
    9. Reviews
  6. Section 1: Getting Started with Keycloak
  7. Chapter 1: Getting Started with Keycloak
    1. Technical requirements
    2. Introducing Keycloak
    3. Installing and running Keycloak
      1. Running Keycloak on Docker
      2. Installing and running Keycloak with OpenJDK
    4. Discovering the Keycloak admin and account consoles
      1. Getting started with the Keycloak admin console
      2. Getting started with the Keycloak account console
    5. Summary
    6. Questions
  8. Chapter 2: Securing Your First Application
    1. Technical requirements
    2. Understanding the sample application
    3. Running the application
    4. Understanding how to log in to the application
    5. Securely invoking the backend REST API
    6. Summary
    7. Questions
  9. Section 2: Securing Applications with Keycloak
  10. Chapter 3: Brief Introduction to Standards
    1. Authorizing application access with OAuth 2.0
    2. Authenticating users with OpenID Connect
    3. Leveraging JWT for tokens
    4. Understanding why SAML 2.0 is still relevant
    5. Summary
    6. Questions
  11. Chapter 4: Authenticating Users with OpenID Connect
    1. Technical requirements
    2. Running the OpenID Connect playground
    3. Understanding the Discovery endpoint
    4. Authenticating a user
    5. Understanding the ID token
      1. Updating the user profile
      2. Adding a custom property
      3. Adding roles to the ID token
    6. Invoking the UserInfo endpoint
    7. Dealing with users logging out
      1. Initiating the logout
      2. Leveraging ID and access token expiration
      3. Leveraging OIDC Session Management
      4. Leveraging OIDC Back-Channel Logout
      5. A note on OIDC Front-Channel Logout
      6. How should you deal with logout?
    8. Summary
    9. Questions
    10. Further reading
  12. Chapter 5: Authorizing Access with OAuth 2.0
    1. Technical requirements
    2. Running the OAuth 2.0 playground
    3. Obtaining an access token
    4. Requiring user consent
    5. Limiting the access granted to access tokens
      1. Using the audience to limit token access
      2. Using roles to limit token access
      3. Using the scope to limit token access
    6. Validating access tokens
    7. Summary
    8. Questions
    9. Further reading
  13. Chapter 6: Securing Different Application Types
    1. Technical requirements
    2. Understanding internal and external applications
    3. Securing web applications
      1. Securing server-side web applications
      2. Securing a SPA with a dedicated REST API
      3. Securing a SPA with an intermediary REST API
      4. Securing a SPA with an external REST API
    4. Securing native and mobile applications
    5. Securing REST APIs and services
    6. Summary
    7. Questions
    8. Further reading
  14. Chapter 7: Integrating Applications with Keycloak
    1. Technical requirements
    2. Choosing an integration architecture
    3. Choosing an integration option
    4. Integrating with Golang applications
      1. Configuring a Golang client
    5. Integrating with Java applications
      1. Using Quarkus
      2. Using Spring Boot
      3. Using Keycloak adapters
    6. Integrating with JavaScript applications
    7. Integrating with Node.js applications
      1. Creating a Node.js resource server
    8. Integrating with Python applications
      1. Creating a Python client
      2. Creating a Python resource server
    9. Using a reverse proxy
    10. Try not to implement your own integration
    11. Summary
    12. Questions
    13. Further reading
  15. Chapter 8: Authorization Strategies
    1. Understanding authorization
    2. Using RBAC
    3. Using GBAC
      1. Mapping group membership into tokens
    4. Using OAuth2 scopes
    5. Using ABAC
    6. Using Keycloak as a centralized authorization server
    7. Summary
    8. Questions
    9. Further reading
  16. Section 3: Configuring and Managing Keycloak
  17. Chapter 9: Configuring Keycloak for Production
    1. Technical requirements
    2. Setting the hostname for Keycloak
      1. Setting the frontend URL
      2. Setting the backend URL
      3. Setting the admin URL
    3. Enabling TLS
    4. Configuring a database
    5. Enabling clustering
    6. Configuring a reverse proxy
      1. Distributing the load across nodes
      2. Forwarding client information
      3. Keeping session affinity
    7. Testing your environment
      1. Testing load balancing and failover
      2. Testing the frontend and backchannel URLs
    8. Summary
    9. Questions
    10. Further reading
  18. Chapter 10: Managing Users
    1. Technical requirements
    2. Managing local users
      1. Creating a local user
      2. Managing user credentials
      3. Obtaining and validating user information
      4. Enabling self-registration
      5. Managing user attributes
    3. Integrating with LDAP and Active Directory
      1. Understanding LDAP mappers
      2. Synchronizing groups
      3. Synchronizing roles
    4. Integrating with third-party identity providers
      1. Creating a OpenID Connect identity provider
    5. Integrating with social identity providers
    6. Allowing users to manage their data
    7. Summary
    8. Questions
    9. Further reading
  19. Chapter 11: Authenticating Users
    1. Technical requirements
    2. Understanding authentication flows
      1. Configuring an authentication flow
    3. Using passwords
      1. Changing password policies
      2. Resetting user passwords
    4. Using OTPs
      1. Changing OTP policies
      2. Allowing users to choose whether they want to use OTP
      3. Forcing users to authenticate using OTP
    5. Using Web Authentication (WebAuthn)
      1. Enabling WebAuthn for an authentication flow
      2. Registering a security device and authenticating
    6. Using strong authentication
    7. Summary
    8. Questions
    9. Further reading
  20. Chapter 12: Managing Tokens and Sessions
    1. Technical requirements
    2. Managing sessions
      1. Managing session lifetimes
      2. Managing active sessions
      3. Expiring user sessions prematurely
      4. Understanding cookies and their relation to sessions
    3. Managing tokens
      1. Managing ID tokens' and access tokens' lifetimes
      2. Managing refresh tokens' lifetimes
      3. Enabling refreshing token rotation
      4. Revoking tokens
    4. Summary
    5. Questions
    6. Further reading
  21. Chapter 13: Extending Keycloak
    1. Technical requirements
    2. Understanding Service Provider Interfaces
      1. Packaging a custom provider
      2. Installing a custom provider
      3. Understanding the KeycloakSessionFactory and KeycloakSession components
      4. Understanding the life cycle of a provider
      5. Configuring providers
    3. Changing the look and feel
      1. Understanding themes
      2. Creating and deploying a new theme
      3. Extending templates
      4. Extending theme-related SPIs
    4. Customizing authentication flows
    5. Looking at other customization points
    6. Summary
    7. Questions
    8. Further reading
  22. Section 4: Security Considerations
  23. Chapter 14: Securing Keycloak and Applications
    1. Securing Keycloak
      1. Encrypting communication to Keycloak
      2. Configuring the Keycloak hostname
      3. Rotating the signing keys used by Keycloak
      4. Regularly updating Keycloak
      5. Loading secrets into Keycloak from an external vault
      6. Protecting Keycloak with a firewall and an intrusion prevention system
    2. Securing the database
      1. Protecting the database with a firewall
      2. Enabling authentication and access control for the database
      3. Encrypting the database
    3. Securing cluster communication
      1. Enabling cluster authentication
      2. Encrypting cluster communication
    4. Securing user accounts
    5. Securing applications
      1. Web application security
      2. OAuth 2.0 and OpenID Connect best practice
      3. Keycloak client configurations
    6. Summary
    7. Questions
    8. Further reading
  24. Assessments
    1. Chapter 1
    2. Chapter 2
    3. Chapter 3
    4. Chapter 4
    5. Chapter 5
    6. Chapter 6
    7. Chapter 7
    8. Chapter 8
    9. Chapter 9
    10. Chapter 10
    11. Chapter 11
    12. Chapter 12
    13. Chapter 13
    14. Chapter 14
    15. Why subscribe?
  25. Other Books You May Enjoy
    1. Packt is searching for authors like you
    2. Leave a review - let other readers know what you think

Product information

  • Title: Keycloak - Identity and Access Management for Modern Applications
  • Author(s): Stian Thorgersen, Pedro Igor Silva
  • Release date: June 2021
  • Publisher(s): Packt Publishing
  • ISBN: 9781800562493