Keycloak basic authentication with Spring Security 6

Getting advice
1

Hello Friends,
I am trying to my legacy spring boot 2.7.x application to spring boot 3.
There we had a basic authentication entry point implementation written with the help of keycloak-spring-security-adapter.
I know it is deprecated now, but I couldn’t find any good example of implementing basic authentication with the help of keycloak.
Expecting help here…!!!

2

Try to migrate to using standard OpenID Connect with Spring Security for authentication purposes and OAuth 2.0 acting as Resource Server related to APIs for authorization.

Here, you have an example with multiples OIDC providers:

Alternatively, you can check out an API (RS) example:

1 Like
3

Thanks for the reply…
Will this be helpful to authenticate and authorise requests coming to the resource server with “Authorization: Basic xxxxxxx” header?
Does Springsecurity integration of the resource server act as the client for the Keycloak?

4

I believe you’re mixing up the ideas.

An API acting as a Resource Server follows the OAuth 2.0 standard [1]. In this case, the API will receive an access token (JWT or opaque) in the Authorization header with the format Bearer {access-token-value} [2]. Period. There is no other way.
Spring Security supports OAuth 2.0 [3], therefore, it’s super straightforward.

I always try to recommend to the customer two things: follow modern standards and don’t reinvent the wheel.

[1] RFC 6749 - The OAuth 2.0 Authorization Framework
[2] RFC 6749 - The OAuth 2.0 Authorization Framework
[3] OAuth 2.0 Resource Server JWT :: Spring Security

5

Hi @embesozzi ,
Thanks for pointing this out.
But in this case, I need to stick to the older way.
So I implemented an AuthenticationManager, where it creates the login post request to keycloak API and set the token into the context for authorization.