> For the complete documentation index, see [llms.txt](https://appsec-tmr.gitbook.io/keycloak-workshop/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://appsec-tmr.gitbook.io/keycloak-workshop/readme.md).

# README

[![License](https://img.shields.io/badge/License-Apache%20License%202.0-brightgreen.svg)](http://www.apache.org/licenses/LICENSE-2.0.txt)

## KeyCloak Workshop

Authentication and authorization with KeyCloak. This contains both, theory parts on all important concepts, and hands-on practice labs.

**Table of Contents (Tu Update)**

* [Requirements and Setup](/keycloak-workshop/introduction/setup.md)
* [Hands-On Workshop](#hands-on-workshop)
  * [Intro Labs](#intro-labs)
    * [Lab: Authorization Grant Flows in Action](/keycloak-workshop/intro-labs/oauth-grants.md)
    * [Demo: Auth Code Flow in Action](/keycloak-workshop/intro-labs/auth-code-demo.md)
    * [Demo: GitHub Client](/keycloak-workshop/intro-labs/github-client.md)
  * [Part 1 : OAuth 2.0 and OpenID Connect 1.0](#hands-on-labs)
    * [Lab 1: Resource Server](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab1.md)
    * [Lab 2: Client (Auth Code)](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab2.md)
    * [Lab 3: Client (Client-Credentials)](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab3.md)
    * [Lab 4: Testing JWT Auth\&Authz](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab4.md)
    * [Lab 5: JWT Testing Server](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab5.md)
    * [Lab 6: SPA Client (Authz Code with PKCE)](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab6.md)
  * [Part 2 : Fine-grained authorization](#hands-on-labs)
    * [Lab 7: SpringBoot REST Service Protected Using Keycloak Authorization Services](/keycloak-workshop/part-2-fine-grained-authorization/lab7.md)
    * [Lab 8: Spring Security Application using Authorization Services](/keycloak-workshop/part-2-fine-grained-authorization/lab8.md)
    * [Lab 9: SpringBoot REST Service Protected Using Keycloak Authorization Services (Javascript Policies)](/keycloak-workshop/part-2-fine-grained-authorization/lab9.md)
    * [Lab 10: User-Managed Access (UMA 2.0)](/keycloak-workshop/part-2-fine-grained-authorization/lab10.md)
  * [Part 3 : SAML](#hands-on-labs)
    * [Lab 11: Spring Boot Application with SAML 2.0](/keycloak-workshop/part-3-saml/lab11.md)
    * [Lab 12: SAML SSO using an external identity provider](/keycloak-workshop/part-3-saml/lab12.md)
  * [Part 4 : User Storage Federation](#hands-on-labs)
    * [Lab 13: User federation using LDAP](/keycloak-workshop/part-4-user-storage-federation/lab13.md)
    * [Lab 14: Keycrloak User Stoage SPI](/keycloak-workshop/part-4-user-storage-federation/lab14.md)
  * [Part 5 : MFA](#hands-on-labs)
    * [Lab 15: Keycloak 2FA SMS Authenticator](/keycloak-workshop/part-5-mfa/lab15.md)
    * [Lab 16: Conditional Keycloak 2FA SMS Authenticator](/keycloak-workshop/part-5-mfa/lab16.md)
  * [Part 6 : Identity Brokering](#hands-on-labs)
    * [Lab 17: Using Github as an identity provider](/keycloak-workshop/identity-brokering/lab17.md)
    * [Lab 18: Using Franceconnect as an identity provider](/keycloak-workshop/identity-brokering/lab18.md)
  * [Part 7 : Extending Keycloak](#hands-on-labs)
    * [Lab 19 : Simple Risk-Based Authenticator](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab19/README.md)
    * [Lab 20 : Custom protocol token mapper](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab20/README.md)
    * [Lab 21 : Custom Keycloak Required Action](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab21/README.md)
    * [Lab 22 : Custom Event Listener](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab22/README.md)
    * [Lab 23 : Custom REST resource/endpoint](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab23/README.md)
    * [Lab 24 : Creating and deploying a new theme](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab24/README.md)
  * [Bonus Labs](#bonus-labs)
    * [Multi-Tenant Resource Server](/keycloak-workshop/bonus-labs/multi-tenant-server-app.md)
    * [Resource Server with Micronaut](/keycloak-workshop/bonus-labs/micronaut-server-app.md)
    * [Resource Server with Quarkus](/keycloak-workshop/bonus-labs/quarkus-server-app.md)
    * [Keycloak Testcontainers](/keycloak-workshop/bonus-labs/keycloak-test-containers.md)
    * [Keycloak Gatekeeper](https://github.com/TmmmmmR/keycloak-workshop/blob/main/bonus-labs/kc-gatekeeper/README.md)
    * [SAML](https://github.com/TmmmmmR/keycloak-workshop/blob/main/bonus-labs/saml/README.md)
* [Feedback](#feedback)
* [License](#license)

### Workshop Tutorial

To follow the hands-on workshop please open the [workshop tutorial](https://appsec-tmr.gitbook.io/keycloak-workshop/).

### Requirements and Setup

To check system requirements and setup for this workshop please follow the [setup guide](/keycloak-workshop/introduction/setup.md).

### Hands-On Workshop

#### Intro Labs

* [Lab: Authorization Grant Flows in Action](/keycloak-workshop/intro-labs/oauth-grants.md)
* [Demo: Authorization Code Grant Flow in Action](/keycloak-workshop/intro-labs/auth-code-demo.md)
* [Demo: A pre-defined OAuth2 client for GitHub](/keycloak-workshop/intro-labs/github-client.md)

#### Part 1 : OAuth 2.0 and OpenID Connect 1.0

For the hands-on workshop you will extend a provided sample application along with guided tutorials.

The components you will build (and use) look like this:

![Architecture](/files/uso5bwKSqCsg29rkVxoG)

**Please check out the** [**complete documentation**](/keycloak-workshop/introduction/application-architecture.md) **for the sample application before starting with the first hands-on lab**.

* [Lab 1: OAuth2/OIDC Resource Server](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab1.md)
* [Lab 2: OAuth2/OIDC Web Client (Auth Code Flow)](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab2.md)
* [Lab 3: OAuth2/OIDC Batch Job Client (Client-Credentials Flow)](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab3.md)
* [Lab 4: OAuth2/OIDC Testing Environment](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab4.md)
* [Lab 5: JWT Testing Server](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab5.md)
* [Lab 6: OAuth2/OIDC Angular Client](/keycloak-workshop/part-1-oauth-2.0-and-openid-connect-1.0/lab6.md)

#### Part 2 : Fine-grained authorization

* [Lab 7: SpringBoot REST Service Protected Using Keycloak Authorization Services](/keycloak-workshop/part-2-fine-grained-authorization/lab7.md)
* [Lab 8: Spring Security Application using Authorization Services](/keycloak-workshop/part-2-fine-grained-authorization/lab8.md)
* [Lab 9: SpringBoot REST Service Protected Using Keycloak Authorization Services (Javascript Policies)](/keycloak-workshop/part-2-fine-grained-authorization/lab9.md)
* [Lab 10: User-Managed Access (UMA 2.0)](/keycloak-workshop/part-2-fine-grained-authorization/lab10.md)

#### Part 3 : SAML

* [Lab 11: Spring Boot Application with SAML 2.0](/keycloak-workshop/part-3-saml/lab11.md)
* [Lab 12: SAML SSO using an external identity provider](/keycloak-workshop/part-3-saml/lab12.md)

#### Part 4 : User Storage Federation

* [Lab 13: User federation using LDAP](/keycloak-workshop/part-4-user-storage-federation/lab13.md)
* [Lab 14: Keycloak User Storage SPI](/keycloak-workshop/part-4-user-storage-federation/lab14.md)

#### Part 5 : MFA

* [Lab 15: Keycloak 2FA SMS Authenticator](/keycloak-workshop/part-5-mfa/lab15.md)
* [Lab 16: Conditional Keycloak 2FA SMS Authenticator](/keycloak-workshop/part-5-mfa/lab16.md)

#### Part 6 : Identity Brokering

* [Lab 17: Using Github as an identity provider](/keycloak-workshop/identity-brokering/lab17.md)
* [Lab 18: Using Franceconnect as an identity provider](/keycloak-workshop/identity-brokering/lab18.md)

#### Part 7 : Extending Keycloak

* [Lab 19 : Simple Risk-Based Authenticator](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab19/README.md)
* [Lab 20 : Custom protocol token mapper](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab20/README.md)
* [Lab 21 : Custom Keycloak Required Action](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab21/README.md)
* [Lab 22 : Custom Event Listener](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab22/README.md)
* [Lab 23 : Custom REST resource/endpoint](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab23/README.md)
* [Lab 24 : Creating and deploying a new theme](https://github.com/TmmmmmR/keycloak-workshop/blob/main/lab24/README.md)

#### Bonus Labs

* [Multi-Tenant Resource Server](/keycloak-workshop/bonus-labs/multi-tenant-server-app.md)
* [OAuth2/OIDC Resource Server with Micronaut](/keycloak-workshop/bonus-labs/micronaut-server-app.md)
* [OAuth2/OIDC Resource Server with Quarkus](/keycloak-workshop/bonus-labs/quarkus-server-app.md)
* [Keycloak Testcontainers](/keycloak-workshop/bonus-labs/keycloak-test-containers.md)
* [Keycloak Gatekeeper](https://github.com/TmmmmmR/keycloak-workshop/blob/main/bonus-labs/kc-gatekeeper/README.md)

### Reference

This workshop is based on the following resources :

* [Keycloak Quickstarts Examples](https://github.com/keycloak/keycloak-quickstarts)
* [Securing Microservices with OpenID Connect and Spring Security 5.1 @ Spring I/O 2019](https://github.com/andifalk/oidc-workshop-spring-io-2019) by *@andifalk*.
* [Keycloak/Authorization SpringBoot Example - devconf 2019](https://github.com/mposolda/devconf2019-authz) by *@mposolda*

Any feedback on this hands-on workshop is highly appreciated.

### License

Apache 2.0 licensed