Keycloak - Identity and Access Management for Modern Applications: Harness the power of Keycloak, OpenID Connect, and OAuth 2.0 [Team-IRA]

Gain a firm practical understanding of Keycloak to enable authentication and authorization in applications while leveraging the additional features provided by Keycloak Purchase of the print or Kindle book includes a free PDF eBook Key Features Discover Keycloak by understanding Identity and Access Management and integrating it with existing user bases Implement authentication and authorization in applications using Keycloak 22 Utilize Keycloak in securing applications developed by you and the existing applications in your enterprise Book Description The 2nd Edition of Keycloak - Identity and Access Management for Modern Applications is an updated, comprehensive introduction to Keycloak and its updates. In this new edition, you will learn how to use the latest distribution of Keycloak. The recent versions of Keycloak are now based on Quarkus, which brings a new and improved user experience and a new admin console with a higher focus on usability. You will see how to leverage Spring Security, instead of the Keycloak Spring adapter, while using the latest distribution of Keycloak. As you progress, you will understand the new Keycloak distribution and explore best practices in using OAuth. Finally, you'll cover general best practices and other information on how to protect your applications. By the end of this new edition, you will have learned how to install and manage the latest version of Keycloak to secure new and existing applications using the newest features. What you will learn Understand how to install, configure and manage the latest version of Keycloak Leverage additional features and capabilities of Keycloak in this new version Discover new updates to installing and running Keycloak Secure new and existing applications with Keycloak Safely manage Keycloak in a production environmenT Discover available frameworks and third-party libraries that can expand Keycloak Who this book is for This book is for developers, sysadmins, security engineers, or anyone who wants to leverage Keycloak and its capabilities for application security.. Basic knowledge of app development, authentication, and authorization is expected. Table of Contents Getting Started with Keycloak Securing Your First Application Brief Introduction to Standards Authenticating Users with OIDC Authorizing Access with OAuth 2.0 Securing Different Application Types Integrating Applications with Keycloak Authorization Strategies Configuring Keycloak for Production Managing Users Authenticating Users Managing Tokens and Sessions Extending Keycloak Securing Keycloak and Applications Cover Copyright Table of Contents Preface Chapter 1: Getting Started with Keycloak Technical requirements Introducing Keycloak Installing and running Keycloak Running Keycloak on Docker Installing and running Keycloak with OpenJDK Installing OpenJDK Installing Keycloak Starting Keycloak Discovering the Keycloak admin and account consoles Getting started with the Keycloak admin console Creating and configuring a realm Creating a user Creating a group Creating a global role Getting started with the Keycloak account console Summary Questions Chapter 2: Securing Your First Application Technical requirements Understanding the sample application Running the application Understanding how to log in to the application Securely invoking the backend REST API Summary Questions Chapter 3: Brief Introduction to Standards Authorizing application access with OAuth 2.0 Authenticating users with OpenID Connect Leveraging JWT for tokens Understanding why SAML 2.0 is still relevant Summary Questions Chapter 4: Authenticating Users with OpenID Connect Technical requirements Running the OpenID Connect playground Understanding the Discovery endpoint Authenticating a user Understanding the ID token Updating the user profile Adding a custom property Adding roles to the ID token Invoking the UserInfo endpoint Dealing with users logging out Initiating the logout Leveraging ID and access token expiration Leveraging OIDC Session Management Leveraging OIDC Back-Channel Logout A note on OIDC Front-Channel Logout How should you deal with logout? Summary Questions Further reading Chapter 5: Authorizing Access with OAuth 2.0 Technical requirements Running the OAuth 2.0 playground Obtaining an access token Requiring user consent Limiting the access granted to access tokens Using the audience to limit token access Using roles to limit token access Using the scope to limit token access Validating access tokens Summary Questions Further reading Chapter 6: Securing Different Application Types Technical requirements Understanding internal and external applications Securing web applications Securing server-side web applications Securing a SPA with a dedicated REST API Securing a SPA with an intermediary REST API Securing a SPA with an external REST API Securing native and mobile applications Authenticating with an input-constrained device Securing REST APIs and services Summary Questions Further reading Chapter 7: Integrating Applications with Keycloak Technical requirements Choosing an integration architecture Choosing an integration option Integrating with Golang applications Integrating with Java applications Using Quarkus Creating a Quarkus client Creating a Quarkus resource server Using Spring Boot Creating a Spring Boot client Creating a Spring Boot resource server Integrating with JavaScript applications Integrating with Node.js applications Creating a Node.js client Creating a Node.js resource server Using a reverse proxy Try not to implement your own integration Summary Questions Further reading Chapter 8: Authorization Strategies Understanding authorization Using RBAC Using GBAC Mapping group membership into tokens Using OAuth2 scopes Using ABAC Using Keycloak as a centralized authorization server Summary Questions Further reading Chapter 9: Configuring Keycloak for Production Technical requirements Setting the hostname for Keycloak Setting the frontend URL Setting the backend URL Setting the admin URL Enabling TLS Configuring a database Enabling clustering Configuring a reverse proxy Distributing the load across nodes Forwarding client information Keeping session affinity Testing your environment Testing load balancing and failover Testing the frontend and backchannel URLs Summary Questions Further reading Chapter 10: Managing Users Technical requirements Managing local users Creating a local user Managing user credentials Obtaining and validating user information Enabling self-registration Managing user attributes Integrating with LDAP and Active Directory Understanding LDAP mappers Synchronizing groups Synchronizing roles Integrating with third-party identity providers Creating an OpenID Connect identity provider Integrating with social identity providers Allowing users to manage their data Summary Questions Further reading Chapter 11: Authenticating Users Technical requirements Understanding authentication flows Configuring an authentication flow Using passwords Changing password policies Resetting user passwords Using OTPs Changing OTP policies Allowing users to choose whether they want to use OTPs Forcing users to authenticate using OTPs Using Web Authentication (WebAuthn) Enabling WebAuthn for an authentication flow Registering a security device and authenticating Using strong authentication Summary Questions Further reading Chapter 12: Managing Tokens and Sessions Technical requirements Managing sessions Managing session lifetimes Managing active sessions Expiring user sessions prematurely Understanding cookies and their relation to sessions Managing tokens Managing ID tokens’ and access tokens’ lifetimes Managing refresh tokens’ lifetimes Enabling refreshing token rotation Revoking tokens Summary Questions Further reading Chapter 13: Extending Keycloak Technical requirements Understanding service provider interfaces Packaging and deploying a custom provider Understanding the KeycloakSessionFactory and KeycloakSession components Understanding the life cycle of a provider Changing the look and feel Understanding themes Creating and deploying a new theme Extending templates Extending theme-related SPIs Customizing authentication flows Looking at other customization points Summary Questions Further reading Chapter 14: Securing Keycloak and Applications Securing Keycloak Encrypting communication to Keycloak Configuring the Keycloak hostname Rotating the signing keys used by Keycloak Regularly updating Keycloak Loading secrets into Keycloak from an external vault Protecting Keycloak with a firewall and an intrusion prevention system Securing the database Protecting the database with a firewall Enabling authentication and access control for the database Encrypting the database Securing cluster communication Enabling cluster authentication Encrypting cluster communication Securing user accounts Securing applications Web application security OAuth 2.0 and OpenID Connect best practice Keycloak client configurations Summary Questions Further reading Assessments Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 Chapter 9 Chapter 10 Chapter 11 Chapter 12 Chapter 13 Chapter 14 Packt Page Other Books You May Enjoy Index Gain a firm practical understanding of Keycloak to enable authentication and authorization in applications while leveraging the additional features provided by Keycloak Purchase of the print or Kindle book includes a free PDF eBook Key Features: Discover Keycloak by understanding Identity and Access Management and integrating it with existing user bases Implement authentication and authorization in applications using Keycloak 19 Utilize Keycloak in securing applications developed by you and the existing applications in your enterprise Book Description: The 2nd Edition of Keycloak - Identity and Access Management for Modern Applications is an updated, comprehensive introduction to Keycloak and its updates. In this new edition, you will learn how to use the latest distribution of Keycloak. The recent versions of Keycloak are now based on Quarkus, which brings a new and improved user experience and a new admin console with a higher focus on usability. You will see how to leverage Spring Security, instead of the Keycloak Spring adapter, while using the latest distribution of Keycloak. As you progress, you will understand the new Keycloak distribution and explore best practices in using OAuth. Finally, you'll cover general best practices and other information on how to protect your applications. By the end of this new edition, you will have learned how to install and manage the latest version of Keycloak to secure new and existing applications using the newest features. What You Will Learn: Understand how to install, configure and manage the latest version of Keycloak Leverage additional features and capabilities of Keycloak in this new version Discover new updates to installing and running Keycloak Secure new and existing applications with Keycloak Safely manage Keycloak in a production environment Discover available frameworks and third-party libraries that can be used with Keycloak Who this book is for: This book is for developers, sysadmins, security engineers, or anyone who wants to leverage Keycloak and its capabilities for application security.. Basic knowledge of app development, authentication, and authorization is expected. Gain a practical understanding of Keycloak to enable authentication and authorization in applications while leveraging the additional features provided by Keycloak. Purchase of the print or Kindle book includes a free PDF eBookKey FeaturesA beginners'guide to Keycloak focussed on understanding Identity and Access ManagementImplement authentication and authorization in applications using Keycloak 22Utilize Keycloak in securing applications developed by you and the existing applications in your enterpriseBook DescriptionThe second edition of Keycloak - Identity and Access Management for Modern Applications is an updated, comprehensive introduction to Keycloak and its updates. In this new edition, you will learn how to use the latest distribution of Keycloak. The recent versions of Keycloak are now based on Quarkus, which brings a new and improved user experience and a new admin console with a higher focus on usability. You will see how to leverage Spring Security, instead of the Keycloak Spring adapter while using Keycloak 22. As you progress, you'll understand the new Keycloak distribution and explore best practices in using OAuth. Finally, you'll cover general best practices and other information on how to protect your applications. By the end of this new edition, you'll have learned how to install and manage the latest version of Keycloak to secure new and existing applications using the latest features.What you will learnUnderstand how to install, configure, and manage the latest version of KeycloakDiscover how to obtain access tokens through OAuth 2.0Utilize a reverse proxy to secure an application implemented in any programming language or frameworkSafely manage Keycloak in a production environmentSecure different types of applications, including web, mobile, and native applicationsDiscover the frameworks and third-party libraries that can expand KeycloakWho this book is forThis book is for developers, sysadmins, security engineers, or anyone who wants to leverage Keycloak and its capabilities for application security. Basic knowledge of app development, authentication, and authorization is expected.