SSO for IBD Rest and Keycloak

Single Sign-On (SSO) is an authentication mechanism that enables users to log in once and access multiple applications without repeatedly entering credentials. By centralizing authentication, SSO enhances both security and user experience.

Keycloak

Keycloak is an open-source Identity and Access Management (IAM) solution with authentication and authorization capabilities. It supports SSO using protocols like OAuth 2.0, OpenID Connect (OIDC), and SAML. Keycloak can authenticate users and issue JWTs (JSON Web Tokens), which are then used to authorize API requests.

Role-Based Access Control (RBAC) in Keycloak

Keycloak allows defining roles and assigning them to users. APIs in the Spring Boot application can be categorized as:
  • Public APIs – Accessible without authentication.
  • Secure APIs – Require a valid JWT and are restricted based on user roles.

Flow of SSO Authentication with Keycloak & JWT

The authentication flow with Keycloak and JWT works as follows:

  1. The user logs in to Keycloak with their credentials.
  2. Keycloak validates the credentials and generates an access token (JWT).
  3. When requesting the Spring Boot application, the user includes this JWT in the Authorization header.
  4. The Spring Boot application verifies the JWT.
  5. The application extracts user roles from the token.
  6. Access is granted or denied based on RBAC policies.