Keycloak 3rd Party Client Implementation

Getting advice
1

Hello All,

I’m very new to Keycloak (and SSO) so apologies if these are too much of newbie questions.

We have a frontend React app and a few Spring Boot apis. We set up the React app as a ‘public’ client and the apis as ‘bearer-only’. This was relatively easy to achieve with the JS and Spring Boot plugins though it did require a bunch of rewriting of our Spring Security configuration.

This is where I get confused, we’d like to integrate with a 3rd party website who is also using a JS framework for the UI and Spring/Spring Boot for the apis.

Since a full implementation like we did would be a very hard sell, could they add the JS plugin dependency but only initiate it on a specific landing page they provide for our users?. Is there a better way?

For the backend, they have their own user store and we have ours. When configuring KeycloakWebSecurityConfigurerAdapter, This does require Keycloak but it’s instance agnostic though the properties in application.yml ARE specific to an instance. This would cause any user that didn’t have a token that originated from our Keycloak instance to fail authentication. It’s seems they’d need to create a Keycloak proxy where our user’s requests would get channeled to, get authenticated, and do a back channel call to their main api.

Is there a better way? Can you configure two auth providers on 1 spring boot app? Am I missing something fundamental? Any advice or help would be very appreciated.

2

If I undestood correctly, you have two separate authentication servers that want to allow login from each other.

Think about that as you and google. You both have your user base, your authentication server and one (you) want to trust the other (google), so google users can login in your application using their google credentials.

This can be arranged in Keycloak using external identity providers.

In your Keycloak, you add their openid connect authorization server as an external identity provider and now their users can login into your application.

This will work only if the 3rd party has an openid connect server, if not, maybe the other way around will be easy, as spring security also support external OpenID Connect authorization servers.

Hope that helps.

3

Thanks @weltonrodrigo!

That is helpful. Since we actually want to log into their system, they would need to use our auth server (keycloak) as an external identity provider.

Or would them adding us or we adding them work both ways?