Example: Using Keycloak, MP and OpenLiberty locall
Search…
Example: Using Keycloak, MP and OpenLiberty locall
Introduction
Setup the sample application
Step 1 - Start and configure Keycloak
Step 2 - Understand and configure the Authors microserice on OpenLiberty
Step 3 - Understand the JUnit test implementation
Start the Microservice and execute the test
Step 1 - Start the OpenLiberty server and execute the JUnit test
(Optional) Extract the JWT from a bearer token
Additional Resources
MicroProfile JWT Authentication with Keycloak and React (Philip Riecks)
MicroProfile JWT with Keycloak (Hayri Cicek)
MicroProfile Rest Client for RESTful communication (Philip Riecks)
JAX-RS - @POST with HTML Form Example (LogicBig.com)
Java Code Examples for javax.ws.rs.client.WebTarget (programcreek)
Code sample form and entity (Codota)
API login and JWT token generation using Keycloak (RedHat Developers)
JWT Decoder (JWT.io)
Write and execute a JUnit (Thomas Suedbroecker)
Known problems
Keycloak, not returning access token, if update password action selected
Powered By GitBook
Introduction

Objective

The objective of this project is to provide a "simple" example to access a Java Microservice using the Open Source Identity and Access Management Keycloak and JavaWebToken (JWT).
We want to ...
  • ... secure the Microservice with Authentication​
  • ... secure a specific REST Endpoint invocation of the Microservice with Authorization​
  • ... test the access to the Microservice with a JUnit test.
The Microservice runs on OpenLiberty and uses MicroProfile. The example Microservice is called Authors and is from the open sourced Cloud Native Starter project.The example doesn't use a frontend UI for the Authentication. The JUnit test will authenticate with the Keycloak REST API.
Here is a 7 minutes YouTube video about the setup of the example.
​​
​​

Architecture

The Authors Microservice application supports a protected login with JWT and the specific REST call getAuthors is protected by a specific user role. The image below contains a simplified architecture overview of the example which runs on the local machine, here you see:
  • The JUnit test and Authors Microservice are running on a OpenLiberty server
  • The Authors Microservice is build with MicroProfile
  • The needed JWT Key is saved on the OpenLiberty server in the Authors Microservice using MicroProfile configuration​
  • The JUnit test requests a bearer token to access the Authors service
  • The major configuration information inside Keycloak
Note: In this example Keycloak server is available on localhost:8282 and Authors Microservice on OpenLiberty runs on localhost:3000.
A very simplified overview of the test execution to access Authors Microservice using Keycloak, OpenLiberty, MicroProfile and JWT , is shown in the sequence diagram below.
  1. 1.
    Start the JUnit test called Test_GetAuthors. The test invokes the private operation getToken.
  2. 2.
    Request a bearer token from Keycloak using a REST Endpoint (http://localhost:8282/auth/realms/protocol/openid-connect/token). The request contains the needed Keycloak data for the authorization as parameters to get the bearer token.
    1
    formData.param("username", user)
    2
    .param("password", password)
    3
    .param("realm", realm)
    4
    .param("grant_type", grant_type)
    5
    .param("client_id", client_id);
    Copied!
    That bearer token does contain the Java Web Token, which is protected with the RS256 (RSA Signature with SHA-256). RS256 is a JWT signing algorithm.
  3. 3.
    Proceeding with the test by invoking the private operation getAuthorAuthorized.
  4. 4.
    Now the Authors REST Endpoint (http://localhost:3000/api/v1/getAuthor) is invoked using the bearer token we got from Keycloak, which contains the JWT. The JWT does contain all needed information such as user, role and soon.
  5. 5.
    Verifying the JWT by the Authors Microservice application, that will be done automatically,, by using the given RS256 signed Key for the JWT in our Microservice application on the OpenLiberty server. When the provided Key is validated, the JWT can be used to access the REST Endpoint of the Authors Microservice.
  6. 6.
    Now the Endpoint validates, does the JavaWebToken contain the right role to access the information?
  7. 7.
    Then the response data data will be compared with the expected value.

Setup of the example an overview

  • ​Keycloak​
    For the setup of Keycloak we need ...
    1. 1.
      ... run a local Keycloak Docker image
    2. 2.
      ... add a realm​
    3. 3.
      ... import an existing realm configuration with:
      • Realm Keys
      • Client definition
      • Role and Group definition
      • Groups role mapping
    4. 4.
      ... create a user and add him to the existing group with the role to add the Microservice
  • ​OpenLiberty and MicroProfile​
    For the setup of the Java Microservice with OpenLiberty and MicroProfile with the JUnit test, it's useful to understand the steps from the blog post "Write and execute a JUnit test for a Java Microservice based on MicroProfile and run both in the OpenLiberty development mode".
    We need to ...
    1. 1.
      ... configure the server.xml of OpenLiberty
    2. 2.
      ... add login and security functionality to the AuthorsApplication class
    3. 3.
      ... secure the REST Endpoint in the GetAuthorclass
  • ​JUnit test​
    We need to ...
    1. 1.
      ... use the two-factor authentication to access the Authors Microservice
    2. 2.
      ... use a REST a client to send the requests to the Authors Microservice and Keycloak
    3. 3.
      ... verify Authors Microservice response in the JUnit test

Technologies Used

Compatibility

This project has been created by using following technical environment:
Next - Setup the sample application
Step 1 - Start and configure Keycloak
Last modified 1yr ago
Copy link
Contents
Objective
Architecture
Setup of the example an overview
Technologies Used
Compatibility