spring-auth-demo/keycloak/README.md

keycloak

Companion code for Keycloak with Spring Boot 4.1: Roles, Resource Server and Admin API.

Spring Boot 4.1.1, Spring Security 7.1.1, Keycloak server 26.8.1, keycloak-admin-client 26.0.12, JDK 25.

Piece	Code
Realm with roles, clients, users and a service account	realm/demo-realm.json
Resource server, audience check, Keycloak role mapping	application.yml, SecurityConfig, KeycloakJwtConverter
Method security	ApiController, UserAdminService (@PreAuthorize)
Admin API through keycloak-admin-client	UserAdminService
Tests against a real Keycloak	KeycloakIntegrationTest (skipped when nothing listens on keycloak.url)
Same realm in a container	KeycloakTestcontainersTest (needs Docker)

./scripts/run-all.sh     # downloads Keycloak from Maven Central, imports the realm, runs the tests, writes cap/*.txt

What was and was not run

• Everything in cap/ came from a real Keycloak 26.8.1 (kc.sh start-dev, unpacked from the Maven Central distribution) and the real Spring application. This machine has no Docker.
• KeycloakTestcontainersTest compiles and is skipped without Docker. It was not run, so the Testcontainers path is untested here.
• start-dev is for development only: HTTP, an embedded H2 database, relaxed hostname checks. Production Keycloak needs kc.sh start with TLS, a real database and a configured hostname.
• The users' passwords (password) and the admin-svc client secret in the realm file are demo values.