Extension protected by authentication

Getting advice
1

I want to implement new Keycloak metric extension exposed as REST API. E.g. on endpoint https:///mymetrics. I know how to do this part.

But I have an additional requirement. This endpoint shouldn’t be public. It should be to protect by tokens authentication.

Can anybody suggest if it possible to create Keycloak extension with REST API which will be protected by authentication?

Thank you

2

Whether in or out of Keycloak, it’s possible to protect any REST API endpoint with Keycloak. The general steps are:

  1. Make a “confidential” or “bearer only” client in Keycloak.
  2. Depending on the backend technology you’re using, pick an OIDC library, and configure it with the values from your client.
  3. When you get a request, look for the Authorization: Bearer {token} header, and validate the token (your library might do this for you).

If you are looking for a way to enforce that within a Keycloak REST extension, I have a base class you can look at as an example keycloak-orgs/AbstractAdminResource.java at main · p2-inc/keycloak-orgs · GitHub

1 Like