Securely invoking the backend REST API

Now, open http://localhost:3000/ and click on the Public endpoint link. You will see a message saying Public message!. The public endpoint is not secured by Keycloak, and can be invoked without an access token.

Next, let's try the secured endpoint that is protected by Keycloak. Open http://localhost:3000/ again. This time, click on the Secured endpoint link. Now you will see a message saying Access denied. The Keycloak Node.js adapter is denying requests to this endpoint as it requires a valid access token to invoke the endpoint.

Let's now try to invoke the secured endpoint from the frontend. Open http://localhost:8000/ and click on Invoke Service. You will now see a message displayed saying Secret message!. If instead you get the message Access Denied, this is most likely caused by the user not having the myrole role.

When you click Invoke Service, the frontend sends an AJAX request to the backend service, including the access token in...

Summary

In this chapter, you learned how to secure your first application, consisting of a frontend web application and a backend REST API with Keycloak. You also gained a basic understanding of how Keycloak leverages OpenID Connect to make this all happen in a standard and secure way. Together with what you learned in the first chapter of the book, you now have a solid foundation to start learning more about Keycloak.

In the next chapter, we will dive deeper into securing applications with Keycloak, giving you a better understanding of how it all works.

Questions

1. How does an application authenticate with Keycloak?
2. What do you need to configure in the Keycloak admin console in order to allow an application to authenticate with Keycloak?
3. How does an application securely invoke a protected backend service?

Leveraging JWT for tokens

Keycloak has leveraged JWT as the format for access tokens from the very beginning of the project. This was a very conscious decision for interoperability as well as performance reasons.

Using a standard format, which is relatively easily consumable, makes it easier to integrate with Keycloak. As JWT is based on JSON, it can also easily be parsed and understood in any programming language.

In addition, as the resource servers are now able to directly read the value of the access token, they do not always have to make a request to the OAuth 2.0 token introspection endpoint, or the OpenID Connect UserInfo endpoint. This potentially eliminates two additional requests to Keycloak for a request to the resource server, reducing latency as well as significantly reducing the number of requests to Keycloak.

JWT comes from a family of specifications known as JOSE, which stands for JavaScript Object Signing and Encryption. The related specifications are...

Understanding why SAML 2.0 is still relevant

SAML 2.0 is a mature and robust protocol for authentication and authorization. It is very widely used to enable single sign-on within enterprises and other domains, such as education and government. It was ratified as an OASIS Standard in March 2005, so has been around for a considerable amount of time.

SAML 2.0 is very widely available within enterprise applications, enabling you to easily allow your existing users to authenticate to new applications you wish to deploy. Not only is it available in self-hosted applications but it is also available as an option for a large number of Software-as-a-Service solutions, such as Salesforce, Google Apps, and Office 365. For enterprises, this is a great option when choosing hosted solutions in the cloud as it quickly enables you to allow all your employees access to these solutions, without having to create accounts for each individual employee.

Even though SAML 2.0 is more mature and perhaps...

Summary

In this chapter, you learned how to use OAuth 2.0 to provide your applications, as well as third-party applications, with access to services without exposing credentials, as well as only giving applications exactly what access they need. You also learned how OpenID Connect can be leveraged for single sign-on to your applications, as well as allowing external users to access your applications. Finally, you learned how SAML 2.0 is still an important standard that you should be aware of, even though you may not want to choose it for your own applications.

In the next chapter, you will get a deeper understanding of OAuth 2.0 with a practical guide on how you can use Keycloak to leverage this standard in your applications.

Questions

1. How does OAuth 2.0 allow an application to access resources provided by a different application without asking for the user’s username and password?
2. What does OpenID Connect add to OAuth 2.0?
3. What does JWT add to OAuth 2.0?

Join our community on Discord

Join our community’s Discord space for discussions with the authors and other readers:

https://packt.link/SecNet