Claude
6b09fe7b82
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01VRLbHYdXVEBzGVhYq3pz4q
29 lines
1.6 KiB
Markdown
29 lines
1.6 KiB
Markdown
# keycloak
|
|
|
|
Companion code for **[Keycloak with Spring Boot 4.1: Roles, Resource Server and Admin API](https://ankurm.com/keycloak-spring-boot-4-1-roles-resource-server-admin-api/)**.
|
|
|
|
Spring Boot 4.1.1, Spring Security 7.1.1, Keycloak server 26.8.1, `keycloak-admin-client` 26.0.12, JDK 25.
|
|
|
|
| Piece | Code |
|
|
|---|---|
|
|
| Realm with roles, clients, users and a service account | `realm/demo-realm.json` |
|
|
| Resource server, audience check, Keycloak role mapping | `application.yml`, `SecurityConfig`, `KeycloakJwtConverter` |
|
|
| Method security | `ApiController`, `UserAdminService` (`@PreAuthorize`) |
|
|
| Admin API through `keycloak-admin-client` | `UserAdminService` |
|
|
| Tests against a real Keycloak | `KeycloakIntegrationTest` (skipped when nothing listens on `keycloak.url`) |
|
|
| Same realm in a container | `KeycloakTestcontainersTest` (needs Docker) |
|
|
|
|
```bash
|
|
./scripts/run-all.sh # downloads Keycloak from Maven Central, imports the realm, runs the tests, writes cap/*.txt
|
|
```
|
|
|
|
## What was and was not run
|
|
|
|
- Everything in `cap/` came from a real Keycloak 26.8.1 (`kc.sh start-dev`, unpacked from the Maven Central
|
|
distribution) and the real Spring application. This machine has no Docker.
|
|
- `KeycloakTestcontainersTest` compiles and is skipped without Docker. It was **not** run, so the Testcontainers path
|
|
is untested here.
|
|
- `start-dev` is for development only: HTTP, an embedded H2 database, relaxed hostname checks. Production Keycloak
|
|
needs `kc.sh start` with TLS, a real database and a configured hostname.
|
|
- The users' passwords (`password`) and the `admin-svc` client secret in the realm file are demo values.
|