# keycloak

Companion code for **[Keycloak with Spring Boot 4.1: Roles, Resource Server and Admin API](https://ankurm.com/keycloak-spring-boot-4-1-roles-resource-server-admin-api/)**.

Spring Boot 4.1.1, Spring Security 7.1.1, Keycloak server 26.8.1, `keycloak-admin-client` 26.0.12, JDK 25.

| Piece | Code |
|---|---|
| Realm with roles, clients, users and a service account | `realm/demo-realm.json` |
| Resource server, audience check, Keycloak role mapping | `application.yml`, `SecurityConfig`, `KeycloakJwtConverter` |
| Method security | `ApiController`, `UserAdminService` (`@PreAuthorize`) |
| Admin API through `keycloak-admin-client` | `UserAdminService` |
| Tests against a real Keycloak | `KeycloakIntegrationTest` (skipped when nothing listens on `keycloak.url`) |
| Same realm in a container | `KeycloakTestcontainersTest` (needs Docker) |

```bash
./scripts/run-all.sh     # downloads Keycloak from Maven Central, imports the realm, runs the tests, writes cap/*.txt
```

## What was and was not run

- Everything in `cap/` came from a real Keycloak 26.8.1 (`kc.sh start-dev`, unpacked from the Maven Central
  distribution) and the real Spring application. This machine has no Docker.
- `KeycloakTestcontainersTest` compiles and is skipped without Docker. It was **not** run, so the Testcontainers path
  is untested here.
- `start-dev` is for development only: HTTP, an embedded H2 database, relaxed hostname checks. Production Keycloak
  needs `kc.sh start` with TLS, a real database and a configured hostname.
- The users' passwords (`password`) and the `admin-svc` client secret in the realm file are demo values.