Keycloak tutorial to secure Spring Boot applications

$ wget -c https://downloads.jboss.org/keycloak/3.4.3.Final/keycloak-3.4.3.Final.tar.gz
$ wget -c https://downloads.jboss.org/keycloak/4.8.3.Final/keycloak-4.8.3.Final.tar.gz

$ tar xvfz keycloak-3.4.3.Final.tar.gz
$ tar xvfz keycloak-4.8.3.Final.tar.gz

$ source $PWD/scripts/bashrc
$ echo "!!" >> ~/.bash_profile

$ git clone https://github.com/keycloak/keycloak-quickstarts.git
$ cd keycloak-quickstarts
$ git checkout 4.8.3.Final
$ git apply ../patches/keycloack-quickstarts/4.8.3.Final/pom.xml

$ cd app-authz-rest-springboot

$ mvn spring-boot:run

$ keycloak-lab
$ curl -X POST \
  http://localhost:8180/auth/realms/spring-boot-quickstart/protocol/openid-connect/token \
  -H 'Authorization: Basic YXBwLWF1dGh6LXJlc3Qtc3ByaW5nYm9vdDpzZWNyZXQ=' \
  -H 'content-type: application/x-www-form-urlencoded' \
  -d 'username=alice&password=alice&grant_type=password' \
  | jq -r .access_token > alice.access_token

$ npm install -g jwt-cli

$ jwt $(cat alice.access_token)

ERROR 5729 --- [nio-8080-exec-6] o.k.a.BearerTokenRequestAuthenticator    : Failed to verify token

org.keycloak.exceptions.TokenNotActiveException: Token is not active

$ curl -X POST \
  http://localhost:8180/auth/realms/spring-boot-quickstart/protocol/openid-connect/token \
  -H 'Authorization: Basic YXBwLWF1dGh6LXJlc3Qtc3ByaW5nYm9vdDpzZWNyZXQ=' \
  -H 'content-type: application/x-www-form-urlencoded' \
  -d 'username=jdoe&password=jdoe&grant_type=password' \
  | jq -r .access_token > jdoe.access_token

$ jwt $(cat jdoe.access_token) | grep -e iat: -e exp:

$ mvn test -Pspring-boot

$ keycloak-use 3
$ keycloak-start

$ keycloak-lab
$ git clone https://github.com/paulojeronimo/spring-boot-keycloak-tutorial
$ cd spring-boot-keycloak-tutorial

$ mvn spring-boot:run

$ git branch -a
$ git checkout remotes/origin/spring-security

$ git difftool master...origin/spring-security

$ mvn clean spring-boot:run

$ keycloak-use 4
$ keycloak-install
$ keycloak-start

$ keycloak-lab

$ rm -rf samples/keycloak-resource-server-demo/
$ mkdir -p samples/ && cd $_
$ curl https://start.spring.io/starter.tgz \
  -d bootVersion=2.1.3.RELEASE \
  -d dependencies=web,security \
  -d type=gradle-project \
  -d baseDir=keycloak-resource-server-demo \
  | tar -xzvf -

$ cd keycloak-resource-server-demo
$ git init
$ git add -A
$ git commit -m 'Initial commit'

$ git apply ../../patches/keycloak-resource-server-demo/build.gradle.diff

$ d=src/main/java/com/example/demo
$ cp ../../starts/keycloak-resource-server-demo/$d/HelloEndpoint.java $d/

$ cp ../../starts/keycloak-resource-server-demo/$d/KeycloakSecurityConfigurer.java $d/

$ kcadm.sh config credentials --server http://localhost:8180/auth --realm master --user admin --password admin

$ kcadm.sh create realms -s realm=spring-security-example -s enabled=true

$ CID1=$(kcadm.sh create clients -r spring-security-example -s clientId=curl -s enabled=true -s publicClient=true -s baseUrl=http://localhost:8080 -s adminUrl=http://localhost:8080 -s directAccessGrantsEnabled=true -i)
$ CID2=$(kcadm.sh create clients -r spring-security-example -s clientId=spring-security-demo-app -s enabled=true -s baseUrl=http://localhost:8080 -s bearerOnly=true -i)

$ kcadm.sh create clients/$CID2/roles -r spring-security-example -s name=admin -s 'description=Admin role'
$ kcadm.sh create clients/$CID2/roles -r spring-security-example -s name=user -s 'description=User role'

$ kcadm.sh  get clients/$CID2/installation/providers/keycloak-oidc-keycloak-json -r spring-security-example
{
  "realm" : "spring-security-example",
  "bearer-only" : true,
  "auth-server-url" : "http://localhost:8180/auth",
  "ssl-required" : "external",
  "resource" : "spring-security-demo-app",
  "verify-token-audience" : true,
  "use-resource-role-mappings" : true,
  "confidential-port" : 0
}

$ cat > src/main/resources/application.properties <<'EOF'
keycloak.realm=spring-security-example
keycloak.bearer-only=true
keycloak.auth-server-url=http://localhost:8180/auth
keycloak.ssl-required=external
keycloak.resource=spring-security-demo-app
keycloak.use-resource-role-mappings=true
keycloak.confidential-port=0
EOF

$ joe=$(kcadm.sh create users -r spring-security-example -s username=joe_admin -s enabled=true -i)
$ kcadm.sh update users/$joe/reset-password -r spring-security-example -s type=password -s value=admin -s temporary=false -n
$ kcadm.sh add-roles -r spring-security-example --uusername=joe_admin --cclientid spring-security-demo-app --rolename admin

$ jim=$(kcadm.sh create users -r spring-security-example -s username=jim_user -s enabled=true -i)
$ kcadm.sh update users/$jim/reset-password -r spring-security-example -s type=password -s value=admin -s temporary=false -n
$ kcadm.sh add-roles -r spring-security-example --uusername=jim_user --cclientid spring-security-demo-app --rolename user

$ ./gradlew bootRun

$ export JOE_TOKEN=`curl -ss --data "grant_type=password&client_id=curl&username=joe_admin&password=admin" http://localhost:8180/auth/realms/spring-security-example/protocol/openid-connect/token | jq -r .access_token`

$ jwt $JOE_TOKEN

$ curl -H "Authorization: bearer $JOE_TOKEN" http://localhost:8080/admin/hello
Hello Admin

$ curl -H "Authorization: bearer $JOE_TOKEN" http://localhost:8080/user/hello
{"timestamp":1544591383960,"status":403,"error":"Forbidden","message":"Access is denied","path":"/user/hello"}

$ export JIM_TOKEN=`curl -ss --data "grant_type=password&client_id=curl&username=jim_user&password=admin" http://localhost:8180/auth/realms/spring-security-example/protocol/openid-connect/token | jq -r .access_token`

$ curl -H "Authorization: bearer $JIM_TOKEN" http://localhost:8080/admin/hello
{"timestamp":1544607993019,"status":403,"error":"Forbidden","message":"Access is denied","path":"/admin/hello"}

$ curl -H "Authorization: bearer $JIM_TOKEN" http://localhost:8080/user/hello
Hello User

$ curl http://localhost:8080/guest/hello
Hello Guest

$ git add -A
$ git commit -m 'Added Keycloak support'

$ git apply ../../patches/keycloak-resource-server-demo/src/main/java/com/example/demo/HelloEndpoint.java.diff
$ git apply ../../patches/keycloak-resource-server-demo/src/main/resources/application.properties.diff

$ git difftool

$ ./gradlew bootRun

$ export JOE_TOKEN=`curl -ss --data "grant_type=password&client_id=curl&username=joe_admin&password=admin" http://localhost:8180/auth/realms/spring-security-example/protocol/openid-connect/token | jq -r .access_token`
$ curl -H "Authorization: bearer $JOE_TOKEN" http://localhost:8080/admin/hello

$ cat > README.adoc <<'EOF'
= keycloak-resource-server-demo

This application was created using the steps described in https://github.com/paulojeronimo/keycloak-spring-boot-tutorial#lab-f2[keycloak-spring-boot-tutorial].
EOF

$ git add -A
$ git commit -m 'Added support to show principal name'

$ sdk default java 8u161-oracle

$ uaa-install
$ uaa-start

$ keycloak-lab
$ mkdir -p samples && cd $_
$ git clone https://github.com/paulojeronimo/oauth-uaa-sample
$ cd oauth-uaa-sample