Identity and Access Management (IAM) in Microservices using Keycloak

Securing an enterprise application is a key aspect of modern enterprise application development. There are plenty of mechanisms to secure such applications, especially in distributed environments. Identity and Access Management (IAM) system is one of those very popular security components in a modern day distributed application. Concepts such as Identity Federation, Single Sign On (SSO) and Identity Provisioning are some of those key concepts, which are coupled with IAM systems.

What is Keycloak?

Keycloak is a popular “open source” IAM solutions in the market, which is aimed at securing modern enterprise applications and services. It makes it easy to secure applications and services with little to no code [1].

An IAM solution means, it can provide authentication to your applications as well as helps to manage the users and their access levels / roles / permissions. Furthermore, it has other built-in features like User Federation, Single Sign On (SSO), Centralized Identity Management, Standard Protocols, Client Adapters, Identity brokering and high performance.

How Keycloak Works

Keycloak is completely a separate server that runs in a different place or a different port. Our applications are configured to be secured by this independent server. Keycloak uses open protocol standards like Open ID Connect or SAML 2.0, especially in Identity Federation and SSO scenarios.

In our browser, when we try to access applications, it redirects the browser from the application to the Keycloak authentication server where they enter their credentials. This is important because users are completely isolated from applications and applications never see user credentials. Instead, applications are given an identity token or assertion that is cryptographically signed. These tokens can identify information such as user name, address, email, and other profile data. They can also hold permission data so that applications can make authorization decisions. It can also be used to make secure invocations on REST-based services [1].

If the user credentials provided are correct, the Keycloak Identity Server generates a token and gives it back to the application. If the token is valid, the user is able to continue with the rest of the tasks. When it comes to the context of Microservices architecture, the role of Keycloak is unimaginable with its facility of SSO.

Keycloak in a Microservices Environment

One of Auxenta’s key Telco clients uses Keycloak as its IAM solution for one of their Microservices environments. There are around 40 Microservices, which are federated through a centralized Keycloak environment.

The following diagram shows the message flow in this system:

Steps

This is how a typical JWT, generated by the Keycloak server, looks like. We will notice that this JWT contains all the information about the application user and its Keycloak configurations.

The decrypted form is:

                        {
                          "jti": "e994fc9e-e96e-49ac-ab71-7a2a917674df",
                          "exp": 1533104336,  // Wed Aug 01 2018 11:48:56 GMT+0530 (India Standard Time)
                          "nbf": 0,
                          "iat": 1533104036,  // Wed Aug 01 2018 11:43:56 GMT+0530 (India Standard Time)
                          "iss": "http://localhost:8080/auth/realms/Aplos",
                          "aud": "aplos-frontend",
                          "sub": "8562a2ac-ca92-4741-812a-3557d12da057",
                          "typ": "Bearer",
                          "azp": "aplos-frontend",
                          "nonce": "0ffec321-b829-45e5-83cf-9ab205fc8103",
                          "auth_time": 1533097554,  // Wed Aug 01 2018 09:55:54 GMT+0530 (India Standard Time)
                          "session_state": "2b70a773-42f9-4ebb-b8f6-135150f1486a",
                          "acr": "0",
                          "allowed-origins": [
                            "http://localhost:4000"
                          ],
                          "realm_access": {
                            "roles": [
                              "offline_access",
                              "uma_authorization"
                            ]
                          },
                          "resource_access": {
                            "account": {
                              "roles": [
                                "manage-account",
                                "manage-account-links",
                                "view-profile"
                              ]
                            }
                          },
                          "scope": "openid profile email",
                          "email_verified": false,
                          "name": "FSM MHD",
                          "preferred_username": "fsm",
                          "given_name": "FSM",
                          "family_name": "MHD",
                          "email": "fsm@aplos.com"
                        }
                        

The Demo – Keycloak with Microservices

Follow the steps given below in order to develop a simple Angular Spring Boot Microservice, which can be authenticated by a Keycloak server.

• 2.2 Provide a Keycloak Adaptor

  What are Client Adapters?

  Keycloak client adapters are libraries that make it very easy to secure applications and services with Keycloak. We call these ‘adapters’ rather than libraries as they provide a tight integration to the underlying platform and framework. This makes adapters easy to use and require less boilerplate code than what is typically required by a library. [1]
  
  Now include the following line in the index.html file:

   <-script src="//localhost:8080/auth/js/keycloak.js"><-/script>

  This will download the adapter file from running Keycloak server at the start of the application.
  
  
• 2.3 Include the Keycloak Service File The Folder Structure will be as follows:
  
  
  


• 2.4 Add the KeycloakService.ts file
  The KeycloakService.ts file does the following:
  
  - Handles the process of authorizing the user
  - Connects to the KeyCloak server to get the token and user information and stores it in the application to use wherever needed.
  
  We will have the init() method in the file which will get the Keycloak server information from the environment file and complete the login. In the event of a successful login, it will fetch a JWT as well.
  
  Whenever a new http request is made, the getToken() method will be accessed and if you are logged in, it will obtain a token from the Keycloak server.
  
  

  static init(): Promise< - any - > {
                            const keycloakAuth: any = Keycloak({
                                url: environment.KEYCLOAK_URL,
                                realm: environment.KEYCLOAK_REALM,
                                clientId: environment.KEYCLOAK_CLIENTID
                            });
                    
                            KeycloakService.auth.loggedIn = false;
                    
                            return new Promise((resolve, reject) => {
                                keycloakAuth
                                    .init({ onLoad: 'login-required' })
                                    .success(() => {
                                        KeycloakService.auth.loggedIn = true;
                                        KeycloakService.auth.authz = keycloakAuth;
                                        KeycloakService.auth.logoutUrl =
                                            keycloakAuth.authServerUrl +
                                            '/realms/' +
                                            environment.KEYCLOAK_REALM +
                                            '/protocol/openid-connect/logout?redirect_uri=' +
                                            document.baseURI;
                    
                                        KeycloakService.auth.authz.loadUserProfile().success(data => {
                                            this.user = new User();
                                            this.user.username = data.username;
                                            this.user.firstName = data.firstName;
                                            this.user.lastName = data.lastName;
                                            this.user.email = data.email;
                     
                                            resolve();
                                        });
                                    })
                                    .error(() => {
                                        reject();
                                    });
                            });
                        }
                    }
                     

We will store the Keycloak server details in the environment file, to connect to the server and fetch information. We need to also provide the following information in the environment file:

export const environment = {
                    production: false,
                    KEYCLOAK_URL: 'http://localhost:8080/auth',
                    KEYCLOAK_REALM: 'test-realm',
                    KEYCLOAK_CLIENTID: 'test-client',
                    BACKEND_URL: 'http://localhost:8000/api/'
                  };
                  

Note that our backend root url is also provided here itself.

When the Keycloak.init() method is invoked, we can fetch the user details and the getToken() method is invoked. Then it will update the token with the time period given in the configuration.

When the logout() method is invoked, we set the Keycloak authentication to null and will be redirected to the login page of the respective Keycloak Realm.

When the hasRole(string array) is invoked, it will return a Boolean value by checking whether the logged in user has the role or not.

• 2.5 Adding an http Interceptor Service (KeycloakHttp.ts)
  

  This will extend the standard Angular Http service. Its purpose is to include the authorization token of a logged-in user to every single Http request automatically. That means every request made with the Http service will get the "Bearer" authorization header automatically.

  @Injectable()
                        export class KeycloakHttp extends Http {
                            constructor(_backend: ConnectionBackend, _defaultOptions: RequestOptions, private _keycloakService: KeycloakService) {
                                super(_backend, _defaultOptions);
                            }
                        
                            request(url: string | Request, options?: RequestOptionsArgs): Observable<-Response-> {
                                const tokenPromise: Promise<-string-> = this._keycloakService.getToken();
                                const tokenObservable: Observable<-string-> = Observable.fromPromise(tokenPromise);
                        
                                if (typeof url === 'string') {
                                    return tokenObservable
                                        .map(token => {
                                            const authOptions = new RequestOptions({
                                                headers: new Headers({
                                                    Authorization: 'Bearer ' + token
                                                })
                                            });
                                            return new RequestOptions().merge(options).merge(authOptions);
                                        })
                                        .concatMap(opts => super.request(url, opts));
                                } else if (url instanceof Request) {
                                    return tokenObservable
                                        .map(token => {
                                            url.headers.set('Authorization', 'Bearer ' + token);
                                            return url;
                                        })
                                        .concatMap(request => super.request(request));
                                }
                            }
                        }
                        
                        export function keycloakHttpFactory(backend: XHRBackend, defaultOptions: RequestOptions, keycloakService: KeycloakService) {
                            return new KeycloakHttp(backend, defaultOptions, keycloakService);
                        }
                        
                        export const KEYCLOAK_HTTP_PROVIDER = {
                            provide: Http,
                            useFactory: keycloakHttpFactory,
                            deps: [XHRBackend, RequestOptions, KeycloakService]
                        };
                        
                        

• 2.6 A REST service which has methods to do back-end calls. Let’s name it RestService.ts. This contains the REST service methods.
  

  This consists of the following methods: getAllStaff(), getAllStudents(), getStudentById(id) and getStaffById(id)
  
  Let’s assume that the staff resources can be accessed only by the admin users.

• 2.7 Change the main.ts file to bootstrap our application module only if the authentication credentials are correct.
  

  KeycloakService.init()
                    .then(() => {
                      if (KeycloakService.auth.loggedIn) {
                        platformBrowserDynamic().bootstrapModule(AppModule);
                      } else {
                        KeycloakService.init();
                      }
                    })
                    .catch((e: string) => {
                      console.log('Error Logging : ' + e);
                    });
                    

  Now we will call the init() method of the Keycloak service class and if the app has been successfully logged in to, we will bootstrap our app to load in the browser, and if not Keycloak will automatically redirect the browser to the default login page of the Keycloak server.
  
  Everything is now set in the Angular end.

  • Club House Dolphin Menu PDF Edited
  • Written a Keycloak service class to handle the authentication request
  • Written a http interceptor which intercepts with all http requests and attach tokens
  • Written a REST service to access the resources
  • Arranged a view in app.component,html

Everything is ready in the Spring Boot back-end.

1) Created a Spring Boot app with the mentioned dependencies
2) Written a REST controller class to handle the http REST req
3) Written a Security configuration to apply our security constraints
4) Created application.yml to provide Keycloak info and setup server port
The example explained above can be downloaded from the links given under the Resources section (see below).
Happy Keycloaking

Resources:

Both Angular and Spring boot projects can be downloaded from the following github locations.
Front-end : https://github.com/Faseem/Keycloak-test-FE
Back-end : https://github.com/Faseem/Keycloak-test

References:

1. Keycloak official website: https://www.keycloak.org/