Kotlin + Spring Boot + Keycloak - Securing REST APIs

Hello everyone, In this article, we will learn how to secure the Kotlin + Spring boot REST APIs with Keycloak.GitHub repository link is provided at the end of this tutorial. 

Technologies Used:

  • Kotlin
  • Spring Boot 2.5.5
  • KeyCloak 15.0.2
  • Gradle

Let's begin our journey,

Keycloak - Environment Setup

Let's download the Keycloak-15.0.2 Standalone server distribution from the official source.

Once we've downloaded the Standalone server distribution, we can unzip and start Keycloak from the terminal:

In Windows

unzip keycloak-12.0.1.zip
cd keycloak-12.0.1/bin/
standalone.bat

In Linux / Unix 

$ sudo tar -xvzf keycloak-12.0.1.tar.gz
$ cd keycloak-12.0.1/bin/
$ ./standalone.sh

Create Keycloak Server Initial Admin

Go to http://localhost:8090/auth/ and fill the form in the Administrator Console part. For the purpose of this exercise, knowledgefactory/password will be enough.


Then you should be able to log in to Keycloak Admin Console http://localhost:8080/auth/admin.
And, enter your  admin username and password


On successful login, you will be redirected to the Keycloak Admin console 

Create New Realm 

Create a new realm named knowledgefactory-realm


After creating a new realm, you will be taken to your newly created realm Admin console page, as shown in the image below:

Create Clients

Create a new client named knowledgefactory-client with confidential access type, set its Valid Redirect URIs to, and save your changes.




The credentials tab will show the Client Secret which is required for the Spring Boot Application Keycloak configurations.



Create Realm Level Roles

Let’s create a role: knowledgefactory-admin by clicking Add Role button.


After Save, enabled Composite Roles


This is the basic setup of Keycloak for use with web applications.
                                     

Set up a Spring Boot application

Project Structure:



Project Dependency(build.gradle.kts)

import org.jetbrains.kotlin.gradle.tasks.KotlinCompile

plugins {
   id("org.springframework.boot") version "2.5.5"
   id("io.spring.dependency-management") version "1.0.11.RELEASE"
   kotlin("jvm") version "1.5.31"
   kotlin("plugin.spring") version "1.5.31"
}

group = "com.knf.dev.demo"
version = "0.0.1-SNAPSHOT"
java.sourceCompatibility = JavaVersion.VERSION_11

configurations {
   compileOnly {
      extendsFrom(configurations.annotationProcessor.get())
   }
}

repositories {
   mavenCentral()
}

dependencies {
   implementation("org.springframework.boot:spring-boot-starter-security")
   implementation("org.springframework.boot:spring-boot-starter-web")
   implementation("com.fasterxml.jackson.module:jackson-module-kotlin")
   implementation("org.jetbrains.kotlin:kotlin-reflect")
   implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
   implementation("org.keycloak:keycloak-spring-boot-starter:15.0.2")
   implementation("org.keycloak:keycloak-admin-client:15.0.2")
   implementation(platform("org.keycloak.bom:keycloak-adapter-bom:15.0.2"))
   testImplementation("org.springframework.boot:spring-boot-starter-test")
   testImplementation("org.springframework.security:spring-security-test")
}

tasks.withType<KotlinCompile> {
   kotlinOptions {
      freeCompilerArgs = listOf("-Xjsr305=strict")
      jvmTarget = "11"
   }
}

tasks.withType<Test> {
   useJUnitPlatform()
}

application.properties

server.port = 9080
keycloak.auth-server-url = http://localhost:8080/auth
keycloak.realm = knowledgefactory-realm
keycloak.resource = knowledgefactory-client
keycloak.public-client = true
keycloak.use-resource-role-mappings = true
keycloak.ssl-required = external
server.connection-timeout = 9000
keycloak.credentials.secret = 86996cf7-5030-4a37-948b-99223f8bdabf

Configure Keycloak(SecurityConfig.kt)

package com.knf.dev.demo.kotlinspringkeycloakdemo.config

import org.keycloak.adapters.KeycloakConfigResolver
import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
import org.springframework.security.config.http.SessionCreationPolicy
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper
import org.springframework.security.core.session.SessionRegistryImpl
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(jsr250Enabled = true)
class SecurityConfig : KeycloakWebSecurityConfigurerAdapter() {
    @Throws(Exception::class)
    override fun configure(http: HttpSecurity) {
        super.configure(http)
        http.cors().and().csrf().disable().sessionManagement().
        sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and().authorizeRequests()
            .antMatchers("/employees/unprotected").permitAll()
            .antMatchers("/employees/create").permitAll()
            .antMatchers("/employees/login").permitAll()
            .anyRequest().authenticated()
    }

    @Autowired
    @Throws(Exception::class)
    fun configureGlobal(auth: AuthenticationManagerBuilder) {
        val keycloakAuthenticationProvider = keycloakAuthenticationProvider()
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(SimpleAuthorityMapper())
        auth.authenticationProvider(keycloakAuthenticationProvider)
    }

    @Bean
    override fun sessionAuthenticationStrategy(): SessionAuthenticationStrategy {
        return RegisterSessionAuthenticationStrategy(SessionRegistryImpl())
    }

    @Bean
    fun KeycloakConfigResolver(): KeycloakConfigResolver {
        return KeycloakSpringBootConfigResolver()
    }
}

Service class(KeycloakService.kt)

package com.knf.dev.demo.kotlinspringkeycloakdemo.service

import com.knf.dev.demo.kotlinspringkeycloakdemo.Vo.EmployeeVO
import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder
import org.keycloak.OAuth2Constants
import org.keycloak.admin.client.CreatedResponseUtil
import org.keycloak.admin.client.KeycloakBuilder
import org.keycloak.authorization.client.AuthzClient
import org.keycloak.authorization.client.Configuration
import org.keycloak.representations.idm.CredentialRepresentation
import org.keycloak.representations.idm.UserRepresentation
import org.springframework.beans.factory.annotation.Value
import org.springframework.http.ResponseEntity
import org.springframework.stereotype.Service
import java.util.*


@Service
class KeycloakService {
    @Value("\${keycloak.auth-server-url}")
    private val authServerUrl: String? = null

    @Value("\${keycloak.realm}")
    private val realm: String? = null

    @Value("\${keycloak.resource}")
    private val clientId: String? = null
    private val role = "knowledgefactory-admin"
    private val adminName = "knowledgefactory"
    private val adminPassword = "password"
    private val realmAdmin = "master"
    private val adminClientId = "admin-cli"

    @Value("\${keycloak.credentials.secret}")
    private val clientSecret: String? = null
    fun createEmployee(employeeVo: EmployeeVO): EmployeeVO {
        val keycloak = KeycloakBuilder.builder().serverUrl(authServerUrl)
            .grantType(OAuth2Constants.PASSWORD).realm(realmAdmin).clientId(adminClientId)
            .username(adminName).password(adminPassword)
            .resteasyClient(ResteasyClientBuilder().connectionPoolSize(10).build()).build()
        keycloak.tokenManager().accessToken
        val employee = UserRepresentation()
        employee.isEnabled = true
        employee.username = employeeVo.email
        employee.firstName = employeeVo.firstname
        employee.lastName = employeeVo.lastname
        employee.email = employeeVo.email
        val realmResource = keycloak.realm(realm)
        val usersResource = realmResource.users()
        val response = usersResource.create(employee)
        employeeVo.statusCode =response.status
        employeeVo.status = response.statusInfo.toString()
        if (response.status == 201) {
            val userId = CreatedResponseUtil.getCreatedId(response)
            val passwordCred = CredentialRepresentation()
            passwordCred.isTemporary = false
            passwordCred.type = CredentialRepresentation.PASSWORD
            passwordCred.value = employeeVo.password
            val userResource = usersResource[userId]
            userResource.resetPassword(passwordCred)
            val realmRoleUser = realmResource.roles()[role].toRepresentation()
            userResource.roles().realmLevel().add(Arrays.asList(realmRoleUser))
        }
        return employeeVo
    }

    fun login(employeeVo: EmployeeVO): Any {
        val clientCredentials: MutableMap<String, Any?> = HashMap()
        clientCredentials["secret"] = clientSecret
        clientCredentials["grant_type"] = "password"
        val configuration = Configuration(
            authServerUrl, realm, clientId,
            clientCredentials, null
        )
        val authzClient = AuthzClient.create(configuration)
        val response = authzClient.obtainAccessToken(
            employeeVo.email,
            employeeVo.password
        )
        return ResponseEntity.ok(response)
    }
}

VO class(EmployeeVO.kt)

package com.knf.dev.demo.kotlinspringkeycloakdemo.Vo

class EmployeeVO {

     val email: String? = null
     val password: String? = null
     val firstname: String? = null
     val lastname: String? = null
     var statusCode = 0
     var status: String? = null
   }

Rest Controller(EmployeeController.kt)

package com.knf.dev.demo.kotlinspringkeycloakdemo.controller

import org.springframework.web.bind.annotation.RequestMapping
import org.springframework.web.bind.annotation.RestController
import org.springframework.beans.factory.annotation.Autowired
import com.knf.dev.demo.kotlinspringkeycloakdemo.service.KeycloakService
import org.springframework.web.bind.annotation.PostMapping
import org.springframework.web.bind.annotation.RequestBody
import com.knf.dev.demo.kotlinspringkeycloakdemo.Vo.EmployeeVO
import org.springframework.http.ResponseEntity
import org.springframework.web.bind.annotation.GetMapping

@RequestMapping(value = ["/employees"])
@RestController
class EmployeeController {
    @Autowired
    private val keycloakService: KeycloakService? = null
    @PostMapping(path = ["/create"])
    fun createEmployee(@RequestBody employeeVo: EmployeeVO?): ResponseEntity<*> {
        return ResponseEntity.ok(keycloakService!!.createEmployee(employeeVo!!))
    }

    @PostMapping(path = ["/login"])
    fun login(@RequestBody employeeVo: EmployeeVO?): ResponseEntity<*> {
        return ResponseEntity.ok(keycloakService!!.login(employeeVo!!))
    }

    @get:GetMapping(value = ["/unprotected"])
    val unProtectedData: String
        get() = "This api is not protected."

    @get:GetMapping(value = ["/protected"])
    val protectedData: String
        get() = "This api is protected."
}

Spring Boot Main Class(Application.kt)

package com.knf.dev.demo.kotlinspringkeycloakdemo

import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver
import org.springframework.boot.SpringApplication
import org.springframework.boot.autoconfigure.SpringBootApplication
import org.springframework.context.annotation.Bean

@SpringBootApplication
class Application {
   @Bean
   fun keycloakSpringBootConfigResolver(): KeycloakSpringBootConfigResolver {
      return KeycloakSpringBootConfigResolver()
   }

   companion object {
      @JvmStatic
      fun main(args: Array<String>) {
         SpringApplication.run(Application::class.java, *args)
      }
   }
}

Run

Start Spring Boot: gradle bootRun.

Comments

Post a Comment

Popular posts from this blog

Learn Java 8 streams with an example - print odd/even numbers from Array and List

Example 1: Java 8 program to print odd numbers from a List   import java.util.Arrays; import java.util.List; import java.util.stream.Collectors; /*Java 8 Program to find Odd Numbers from a List*/ public class DriverClass { public static void main( String [] args) { List < Integer > numbers = Arrays. asList( 1 , 4 , 8 , 40 , 11 , 22 , 33 , 99 ); List < Integer > oddNumbers = numbers.stream(). filter(o -> o % 2 != 0 ). collect(Collectors.toList()); System.out.println(oddNumbers); } } 1. Initialize List using Arrays.asList() method. Java's built-in Arrays.asList() method converts an array into a list. This method takes an array as an argument and returns a List object. 2.  Java List interface provides stream() method which returns a sequential Stream with list of Integer as its source. 3. The Java stream filter() method allow
Read more

ReactJS - Bootstrap - Buttons

Image
Bootstrap is a free and open-source front-end development framework for the creation of websites and web apps. It is a free and open-source project, hosted on GitHub, and originally engendered by Twitter.  Let us create a new React app - click here After engendering the React app, the best way to install Bootstrap is via the npm package. To install Bootstrap, navigate to the React app folder, and run the following command. $ npm install react-bootstrap bootstrap --save Example import React from 'react' ; import Button from 'react-bootstrap/Button' ; import 'bootstrap/dist/css/bootstrap.min.css' ; class App extends React.Component { render() { return ( <div> <> <Button variant = "primary" > Primary </Button> { ' ' } <Button variant = "secondary" > Secondary </Button> { ' ' } <Butto
Read more

Spring Core | BeanFactoryPostProcessor | Example

Image
In Spring, the  BeanFactoryPostProcessor is a  functional interface that contains a abstract method postProcessBeanFactory .   It allows us to modify the Spring context’s bean definitions before any beans get created.  BeanFactoryPostProcessor can create new bean definitions or modify existing ones. Since  BeanFactoryPostProcessor  should be called before other bean types are formed, it must be registered as a static method level. BeanFactoryPostProcessor example We are creating a simple maven project. You could clone the code from our GitHub repo. Final Project Directory Complete pom.xml <? xml version ="1.0" encoding ="UTF-8" ?> < project xmlns ="http://maven.apache.org/POM/4.0.0" xmlns:xsi ="http://www.w3.org/2001/XMLSchema-instance" xsi :schemaLocation ="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" > < modelVersion >4.0.0</ modelVersion > < gr
Read more

Spring Boot 3 + Spring Security 6 + Thymeleaf - Registration and Login Example

Image
In this section we will learn how to create user registration and login using Spring boot 3, Spring security 6, Thymeleaf, JPA, and PostgreSQL. The GitHub repository link is provided at the end of this tutorial. You can download the source code. What’s New in Spring Security 6? WebSecurityConfigurerAdapter Removed : The  WebSecurityConfigurerAdapter class was deprecated and then removed in Spring Security 6. Instead, you should now take a more component-based approach and create a bean of type  SecurityFilterChain . Here's an example: @Configuration @EnableWebSecurity public class SecurityConfiguration { @Bean public SecurityFilterChain securityFilterChain ( HttpSecurity http) throws Exception { http .authorizeHttpRequests((requests) -> requests .requestMatchers( "/registration**" ).permitAll() .anyRequest().authenticated() ) .formLogin((form) -> form
Read more

File Upload, Download, And Delete - Azure Blob Storage + Spring Boot Example

Image
In this section, you will learn how to create  a storage account on Microsoft Azure and create a simple spring boot application to perform different file operations such as upload, download, and delete files from the Azure blob storage. A little bit of Background Azure Blob Storage Azure Blob storage is Microsoft's object storage solution for the cloud. Blob storage is optimized for storing massive amounts of unstructured data. Unstructured data is data that doesn't adhere to a particular data model or definition, such as text or binary data. More Info -  https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction Spring Boot Spring Boot makes it easy to create stand-alone, production-grade Spring-based Applications that you can "just run".  More Info -  https://spring.io/projects/spring-boot Create an Azure Storage Account and blob container using Azure Portal Sign in to Azure portal  https://portal.azure.com/#home  and search for " Storage a
Read more

Custom Exception Handling in Quarkus REST API

Image
In this section, we will learn how to handle exceptions in the Quarkus REST application using ExceptionMapper interface implementations. ExceptionMapper is a contract for a provider that will map a thrown application exception to a Response object. We will show you custom exception handling with the help of a simple application, Final  Project Directory: Complete pom.xml  <?xml version = "1.0" ?> <project     xsi:schemaLocation = "http://maven.apache.org/POM/4.0.0     https://maven.apache.org/xsd/maven-4.0.0.xsd"     xmlns = "http://maven.apache.org/POM/4.0.0"     xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance" >     <modelVersion> 4.0.0 </modelVersion>     <groupId> org.knf.dev.demo </groupId>     <artifactId> quarku-custom-exception-handling </artifactId>     <version> 1.0.0-SNAPSHOT </version>     <properties>         <compiler-plugin.version> 3.8.1 </compiler-
Read more

ReactJS, Spring Boot JWT Authentication Example

Image
In this tutorial, we’ll create a user registration & login example using ReactJS, Spring Boot, Spring Security, and JWT authentication. You could download the source code from our Github repository, the download link is provided at the end of this tutorial. Technologies used Backend Technologies: Java 17 Spring Boot 2.7.0 Spring Security Spring Data JPA JWT H2 Database Frontend Technologies: React 17.0.1 Axios 0.27.2 Redux 4.0.5 Bootstrap 4.5.2 ReactJS - SpringBoot - JWT - Flow Backend Project Directory: Frontend Project Directory: Following is the screenshot of our application - User Registration: User Signin: Profile View: Access Resource: We will build two projects:  1. Backend:   spring-boot-security-jwt 2. Frontend: react-redux-jwt Project 1: spring-boot-security-jwt Pom.xml <?xml version = "1.0" encoding = "UTF-8" ?> <project xmlns = "http://maven.apache.org/POM/4.0.0" xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance"
Read more

Java, Spring Boot Mini Project - Library Management System - Download

Image
Hello everyone, Hope you are doing well. Here, we provide a Library Management System mini-project for beginners, it's free for download. Maybe you can build more on top of this project and create your own product, that's all about you. The source code download link is provided at the end of this post. 1. Benefit of this project You could cover the following technologies and features by learning and debugging this mini project. Java 17 Java Stream Java Lamda Expressions Java Records Functional programming Object-oriented programming var Keyword in Java Generics in Java Java Switch Spring boot 2.6.4 Spring Security Thymeleaf template engine OpenCSV Spring Data JPA Server Side Pagination H2 Database  Bootstrap HTML CSS and more... 2. Objective Of Spring Boot On Library Management System The main objective of this project is to manage the details of the books, author, category, and publisher. Only Admin/Librarian will manage all these activities. Also, they can export the data in
Read more

Top 5 Java ORM tools - 2024

Image
  The term ORM refers to object-relational mapping, which uses objects to adapt programming languages to database systems while allowing them to function with SQL and object-oriented programming ideas. Any kind of database management system that can accomplish object mapping to the table in the virtual system is suitable for the implementation of ORM. Java has a wide variety of ORM tools, some of which are mentioned below: 1. Hibernate Hibernate is a lightweight, open-source, non-invasive Java ORM (Object-Relational Mapping) framework that allows developers to create objects that function independently of database software and create persistence logic in any Java or JavaEE application. It offers an abstraction layer, so developers don't have to bother about implementations; Hibernate handles these tasks internally, such as connecting to databases and creating queries to carry out CRUD operations, among other things. Persistence logic development is done with it. Persistence logic r
Read more

Spring Boot + Kafka - Producer and Consumer Example

Image
  In this section, we will learn how to do asynchronous communication using  Kafka  in  Spring Boot  application. We will develop two Spring Boot applications, one  producer  and one  consumer  application, then  we will learn how to use  Kafka  in the Spring boot application to send and receive messages between the Producer and the Consumer. In the digital world, different systems are constantly sending or receiving messages. This must be carried out in a controlled manner so that messages do not block each other, end up creating a jam and processes cannot function optimally. In order for applications to be able to communicate with each other easily, it makes sense to create an intermediary, that is, a service that is responsible for managing the distribution of messages: this is what is known as a  messaging broker .  Kafka , one of the best known. 1.  What we will build? We will develop two Spring Boot applications, one  producer  and one  consumer  application, then  we will learn
Read more