Add keycloak project: realm import, resource server with realm and client role mapping, audience and issuer traps, method security, admin client

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VRLbHYdXVEBzGVhYq3pz4q

keycloak/cap/01-claims.txt

@@ -0,0 +1,16 @@
+user=alice client=demo-cli
+  iss="http://localhost:8180/realms/demo" azp="demo-cli" aud=(absent)
+  realm_access={"roles":["user"]} resource_access=(absent)
+  scope="profile email"
+user=alice client=demo-cli-aud
+  iss="http://localhost:8180/realms/demo" azp="demo-cli-aud" aud="spring-api"
+  realm_access={"roles":["user"]} resource_access=(absent)
+  scope="profile email"
+user=bob client=demo-cli
+  iss="http://localhost:8180/realms/demo" azp="demo-cli" aud="spring-api"
+  realm_access={"roles":["admin","user"]} resource_access={"spring-api":{"roles":["reports-write"]}}
+  scope="profile email"
+service account admin-svc (client credentials)
+  preferred_username="service-account-admin-svc" resource_access={"realm-management":{"roles":["view-realm","manage-users","view-users","query-groups","query-users"]}}
+same login through http://127.0.0.1:8180 instead of localhost
+  iss="http://127.0.0.1:8180/realms/demo"

keycloak/cap/02-authorities.txt

@@ -0,0 +1,4 @@
+alice: Spring's default JwtGrantedAuthoritiesConverter -> [SCOPE_email, SCOPE_profile]
+alice: KeycloakJwtConverter roles                      -> [ROLE_user]
+bob: Spring's default JwtGrantedAuthoritiesConverter -> [SCOPE_email, SCOPE_profile]
+bob: KeycloakJwtConverter roles                      -> [ROLE_admin, ROLE_spring-api:reports-write, ROLE_user]

keycloak/cap/03-endpoints.txt

@@ -0,0 +1,8 @@
+caller                                   /api/me  /api/reports  /api/reports/export  /api/admin/users
+no token                                     401           401                  401               401
+garbage token                                401           401                  401               401
+alice, client with audience mapper           200           200                  403               403
+bob,   client with audience mapper           200           200                  200               200
+alice, client WITHOUT audience mapper        401           401                  401               401
+bob,   client WITHOUT audience mapper        200           200                  200               200
+alice, token issued via 127.0.0.1            401           401                  401               401

keycloak/cap/04-admin-client.txt

@@ -0,0 +1,8 @@
+GET /api/admin/users as bob -> ["alice","bob"]
+POST /api/admin/users {carol} as bob -> status=200 (id returned: true)
+GET /api/admin/users as bob -> ["alice","bob","carol"]
+carol logs in; realm_access={"roles":["offline_access","default-roles-demo","uma_authorization","user"]}
+carol -> /api/reports status=200, /api/admin/users status=403
+DELETE /api/admin/users/{id} as bob -> status=200
+GET /api/admin/users as bob -> ["alice","bob"]
+POST /api/admin/users as alice (no admin role) -> status=403

keycloak/cap/05-keycloak-startup.txt

@@ -0,0 +1,4 @@
+Keycloak distribution: keycloak-quarkus-dist-26.8.1 from Maven Central (start-dev, built-in H2 database)
+INFO  [org.keycloak.services] (main) KC-SERVICES0030: Full model import requested. Strategy: IGNORE_EXISTING
+INFO  [org.keycloak.exportimport.util.ImportUtils] (main) Realm 'demo' imported
+INFO  [io.quarkus] (main) Keycloak 26.8.1 on JVM (powered by Quarkus 3.40.1) started in 30.899s. Listening on: http://localhost:8180