Extending Keycloak

At this point, you should have a good idea of what Keycloak has to offer as an Identity and Access Management (IAM) solution. You may also be trying to correlate what you have learned so far with the use cases you need to solve and how to leverage Keycloak capabilities to fit into your requirements.

Although Keycloak offers a rich configuration model that allows you to easily adapt its capabilities according to your needs, it is expected that the standard configuration is not enough to sort out all of them.

Among other questions, you are probably asking yourself how to change Keycloak pages to comply with your own User Interface (UI) and User Experience (UX) patterns. Or perhaps how Keycloak can leverage and integrate into a legacy database identity store to fetch identity-related data for existing users. Or maybe – and I promise this is my last example – you want to send audit events to a fraud detection system and integrate with it for risk...

Technical requirements

During this chapter, you are going to need a development environment with the Java Development Kit (JDK) 17 specifications.

You also need to have a local copy of the GitHub repository associated with the book. If you have Git installed, you can clone the repository by running this command in a terminal:

$ git clone https://github.com/PacktPublishing/Keycloak---Identity-and-Access-Management-for-Modern-Applications-2nd-Edition 

Alternatively, you can download a ZIP of the repository from https://github.com/PacktPublishing/Keycloak---Identity-and-Access-Management-for-Modern-Applications-2nd-Edition/archive/main.zip.

The examples you are going to follow along with in this chapter are available from the following directory within the repository:

$ cd Keycloak---Identity-and-Access-Management-for-Modern-Applications-2nd-Edition/ch13

For this chapter, you also need to create a myrealm realm to follow some examples. You will also need to...

Understanding service provider interfaces

If you are already familiar with the Java language, you probably know what an SPI is. If not, think about it as a pluggable mechanism to add or change behavior to an extensible Java application without changing its code base.

Keycloak is built with extensibility in mind, where features are implemented using a set of well-defined interfaces. Features such as the ability to authenticate users using different authentication mechanisms, auditing, integration with legacy systems to fetch identity data, mapping claims into tokens, registering new users and updating their profiles, and integrating with third-party identity providers are all backed by a set of service interfaces and a corresponding SPI. The same is also true for core features, such as caching, storage, or the different security protocols supported by Keycloak, although for those, you would hardly have a need to customize:

Figure 13.1: Keycloak Service Provider Interface...

Changing the look and feel

One of the main customization hooks – and probably what people use most – is changing Keycloak’s built-in themes to fit with your branding and respect your UI and UX requirements.

Keycloak provides an amazingly simple experience to change themes and allows you to change most – if not all – of its UI, from the end user-facing pages to the administration console itself.

In this topic, you will learn about the basics of theming by going through examples of how to change the look and feel of the login page. By understanding these basics, you should then be able to apply the same concepts to any other UI you want to customize.

This is probably one of the most documented features of Keycloak. Consider looking at the documentation available at https://www.keycloak.org/docs/latest/server_development/#_themes.

Understanding themes

Just like any other feature in Keycloak, themes are backed by their...

Customizing authentication flows

As you learned from Chapter 11, Authenticating Users, Keycloak allows you to easily customize user authentication by changing authentication flows through the administration console. Eventually, the built-in authentication executions might not be enough to address your authentication requirements, and, in this case, you can leverage the Authentication SPI to implement your own authentication executions.

We are not going to cover in this section all the details pertaining to the Authentication SPI, but instead give you a code example to help you understand the steps and mechanics when you create your own authenticators. The code example for this topic is available from the GitHub repository at ch13/simple-risk-based-authenticator.

The example here is about a simple authenticator that relies on a risk score to determine whether the user should provide a second factor when authenticating. The risk score is calculated based only on the number of...

Looking at other customization points

In the previous sections, you learned about just a subset of the extension points that you have available in Keycloak. As mentioned earlier, Keycloak is built around the concept of SPIs and there are many other customization points that you might find useful.

The best source for querying the available SPIs is the documentation available at https://www.keycloak.org/docs/latest/server_development. Some key SPIs are also covered by examples in the Keycloak Quickstart repository available at https://github.com/keycloak/keycloak-quickstarts/.

From the documentation, you may be interested in looking at the following SPIs:

• User Storage
• Event Listener

The User Storage SPI allows you to integrate Keycloak with any external identity store. A common use case for it is to fetch identity data from an existing database:

• Documentation: https://www.keycloak.org/docs/latest/server_development/#_user-storage-spi
...

Summary

In this chapter, you learned about one of the main aspects of Keycloak: extensibility. You learned that Keycloak not only helps you to deploy IAM to your ecosystem but also adapts IAM to your needs.

To understand this, you were taught the basics of how to change the look and feel of a server using themes and how to implement custom providers using some of the available SPIs. Although you were presented with only a few examples of how to extend Keycloak, you should be able to leverage what you learned from this chapter to extend Keycloak using any SPI.

In the next chapter, you will look at some security best practices and considerations when using Keycloak.

Questions

1. What is a public and private SPI?
2. How do I deploy my extensions?
3. Can I change the look and feel of Keycloak
4. Is it possible to customize how users authenticate to Keycloak?
5. Do I need to be a Java developer to extend Keycloak?

Further reading

For more information on the topics covered in this chapter, you can visit the following links:

• Configuring providers: https://www.keycloak.org/server/configuration-provider
• Keycloak Server Developer Guide: https://www.keycloak.org/docs/latest/server_development
• Apache FreeMarker: https://freemarker.apache.org/
• Java service provider interface: https://docs.oracle.com/javase/tutorial/ext/basics/spi.html
• Keycloak GitHub repository: https://github.com/keycloak/keycloak

Join our community on Discord

Join our community’s Discord space for discussions with the authors and other readers:

https://packt.link/SecNet