Keycloak Identity Management Guide

helm install keycloak bitnami/keycloak \
  --namespace auth --create-namespace \
  --set auth.adminUser=admin \
  --set auth.adminPassword=changeme \
  --set postgresql.enabled=true

Realm → Clients → Users → Roles → Groups

{
  "clientId": "order-app",
  "protocol": "openid-connect",
  "publicClient": true,
  "redirectUris": ["https://orders.myorg.com/*"],
  "webOrigins": ["https://orders.myorg.com"],
  "standardFlowEnabled": true
}

// keycloak.ts
import Keycloak from 'keycloak-js';

const keycloak = new Keycloak({
  url: 'https://auth.myorg.com',
  realm: 'production',
  clientId: 'order-app',
});

export default keycloak;

// App.tsx
import { ReactKeycloakProvider } from '@react-keycloak/web';
import keycloak from './keycloak';

function App() {
  return (
    <ReactKeycloakProvider authClient={keycloak}>
      <Routes />
    </ReactKeycloakProvider>
  );
}

// ProtectedPage.tsx
import { useKeycloak } from '@react-keycloak/web';

function OrdersPage() {
  const { keycloak } = useKeycloak();

  if (!keycloak.authenticated) {
    keycloak.login();
    return null;
  }

  return (
    <div>
      <p>Welcome, {keycloak.tokenParsed?.preferred_username}</p>
      <button onClick={() => keycloak.logout()}>Logout</button>
    </div>
  );
}

// Express.js middleware
import jwt from 'jsonwebtoken';
import jwksClient from 'jwks-rsa';

const client = jwksClient({
  jwksUri: 'https://auth.myorg.com/realms/production/protocol/openid-connect/certs',
});

async function verifyToken(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).json({ error: 'No token' });

  const decoded = jwt.decode(token, { complete: true });
  const key = await client.getSigningKey(decoded.header.kid);

  jwt.verify(token, key.getPublicKey(), {
    issuer: 'https://auth.myorg.com/realms/production',
    audience: 'order-api',
  });

  req.user = jwt.decode(token);
  next();
}

function requireRole(role: string) {
  return (req, res, next) => {
    const roles = req.user?.realm_access?.roles || [];
    if (!roles.includes(role)) {
      return res.status(403).json({ error: 'Forbidden' });
    }
    next();
  };
}

app.delete('/api/orders/:id', requireRole('admin'), deleteOrder);

Realm Settings → Identity Providers → Add Provider → Google
  Client ID: from Google Cloud Console
  Client Secret: from Google Cloud Console

Realm Settings → Authentication → Flows → Browser
  → Add Execution → OTP Form
  → Set Requirement: Required

Clients → Create → Protocol: SAML
  Client ID: urn:myorg:legacy-app
  Master SAML Processing URL: https://legacy-app.myorg.com/saml/callback