Keycloak - Identity and Access Management for Modern Applications

By Stian Thorgersen , Pedro Igor Silva
    Advance your knowledge in tech with a Packt subscription

  • Instant online access to over 7,500+ books and videos
  • Constantly updated with 100+ new titles each month
  • Breadth and depth in over 1,000+ technologies
  1. Chapter 1: Getting Started with Keycloak

About this book

Implementing authentication and authorization for applications can be a daunting experience, often leaving them exposed to security vulnerabilities. Keycloak is an open-source solution for identity management and access management for modern applications.

Keycloak - Identity and Access Management for Modern Applications is a comprehensive introduction to Keycloak, helping you get started with using it and securing your applications. Complete with hands-on tutorials, best practices, and self-assessment questions, this easy-to-follow guide will show you how to secure a sample application and then move on to securing different application types. As you progress, you will understand how to configure and manage Keycloak as well as how to leverage some of its more advanced capabilities. Finally, you'll gain insights into securely using Keycloak in production.

By the end of this book, you will have learned how to install and manage Keycloak as well as how to secure new and existing applications.

Publication date:
June 2021


Chapter 2: Securing Your First Application

In this chapter, you will learn how to secure your first application with Keycloak. To make things a bit more interesting, the sample application you will be running consists of two parts, a frontend web application and a backend REST API. This will show you how a user can authenticate to the frontend, and also how the frontend is able to securely invoke the backend.

By the end of this chapter, you will have a basic understanding of how applications can be secured by Keycloak by leveraging OpenID Connect.

In this chapter, we're going to cover the following main topics:

  • Understanding the sample application
  • Running the application
  • Understanding how to log in to the application
  • Securely invoking the backend REST API

Technical requirements

To run the sample application included in this chapter, you need to have Node.js ( installed on your workstation.

You also need to have a local copy of the GitHub repository associated with the book. If you have Git installed, you can clone the repository by running this command in a terminal:

$ git clone

Alternatively, you can download a ZIP of the repository from

Check out the following link to see the Code in Action video:


Understanding the sample application

The sample application consists of two parts – a frontend web application and a backend REST API.

The frontend web application is a single-page application written in JavaScript. As we want to focus on what Keycloak can offer, the application is very simple. Furthermore, to make it as simple as possible to run the application, it uses Node.js. The application provides the following features:

  • Login with Keycloak.
  • It displays the user's name.
  • It displays the user's profile picture, if available.
  • It shows the ID token.
  • It shows the Access token.
  • It refreshes the tokens.
  • It invokes the secured endpoint provided by the backend.

The backend REST API is also very simple, and is implemented with Node.js. It provides a REST API with two endpoints:

  • /public: A publicly available endpoint with no security
  • /secured: A secured endpoint requiring an access token with the myrealm global role...

Running the application

In this section, you will learn how to run the sample application.

If you don't already have Node.js installed on your workstation, go to for instructions on how to install it.

To run the frontend on Node.js, open a terminal and run the following commands:

$ cd Keycloak-Identity-and-Access-Management-for-Modern-Applications/ch2/frontend/
$ npm install
$ npm start

Next, open a new terminal to run the backend using the following commands:

$ cd Keycloak-Identity-and-Access-Management-for-Modern-Applications/ch2/backend/
$ npm install
$ npm start

Now that you have the sample application running with Node.js, you can register it with Keycloak, which we will cover in the next section.


Understanding how to log in to the application

In the previous chapter, covering how to get started with Keycloak, you learned how to run Keycloak, as well as how to create your first realm. Prior to continuing this section, you should have Keycloak running with the realm created as covered in the previous chapter. In summary, what you require before continuing is the following:

  • Keycloak up and running
  • A realm named myrealm
  • A global role named myrole
  • A user with the preceding role

Before an application can log in with Keycloak, it has to be registered as a client with Keycloak.

Before registering the frontend, let's see what happens if an unregistered application tries to authenticate with Keycloak. Open http://localhost:8000 and then click on the Login button.

You will see an error page from Keycloak with the message Client not found. This error is telling you that the application is not registered with Keycloak.

To register the frontend with...


Securely invoking the backend REST API

Now, open http://localhost:3000/ and click on the Public endpoint link. You will see a message saying Public message!. The public endpoint is not secured by Keycloak, and can be invoked without an access token.

Next, let's try the secured endpoint that is protected by Keycloak. Open http://localhost:3000/ again. This time, click on the Secured endpoint link. Now you will see a message saying Access denied. The Keycloak Node.js adapter is denying requests to this endpoint as it requires a valid access token to invoke the endpoint.

Let's now try to invoke the secured endpoint from the frontend. Open http://localhost:8000/ and click on Invoke Service. You will now see a message displayed saying Secret message!. If instead you get the message Access Denied, this is most likely caused by the user not having the myrole role.

When you click Invoke Service, the frontend sends an AJAX request to the backend service, including the access...



In this chapter, you learned how to secure your first application, consisting of a frontend web application and a backend REST API with Keycloak. You also gained a basic understanding of how Keycloak leverages OpenID Connect to make this all happen in a standard and secure way. Together with what you learned in the first chapter of the book, you now have a solid foundation to start learning more about Keycloak.

In the next chapter, we will dive deeper into securing applications with Keycloak, giving you a better understanding of how it all works.



  1. How does an application authenticate with Keycloak?
  2. What do you need to configure in the Keycloak admin console in order to allow an application to authenticate with Keycloak?
  3. How does an application securely invoke a protected backend service?

About the Authors

  • Stian Thorgersen

    Stian Thorgersen started his career at Arjuna Technologies building a cloud federation platform, years before most companies were even ready for a single-vendor public cloud. He later joined Red Hat, looking for ways to make developers' lives easier, which is where the idea of Keycloak started. In 2013, Stian co-founded the Keycloak project with another developer at Red Hat.

    Today, Stian is the Keycloak project lead and is also the top contributor to the project. He is still employed by Red Hat as a senior principal software engineer focusing on identity and access management, both for Red Hat and for Red Hat's customers.

    In his spare time, there is nothing Stian likes more than throwing his bike down the mountains of Norway.

    Browse publications by this author
  • Pedro Igor Silva

    Pedro Igor Silva is a proud dad of amazing girls. He started his career back in 2000 at an ISP, where he had his first experiences with open source projects such as FreeBSD and Linux, as well as a Java and J2EE software engineer. Since then, he has worked in different IT companies as a system engineer, system architect, and consultant.

    Today, Pedro Igor is a principal software engineer at Red Hat and one of the core developers of Keycloak. His main area of interest and study is now IT security, specifically in the application security and identity and access management spaces.

    In his non-working hours, he takes care of his planted aquariums.

    Browse publications by this author
Book Title
Unlock this book and the full library for FREE
Start free trial