Using Keycloak as a Reverse Proxy for 3rd Party API Authentication

In this article, we will discuss how to use Keycloak as a reverse proxy for 3rd party API authentication. Keycloak is an open-source identity and access management solution that can be used to secure applications and services. By using Keycloak as a reverse proxy, you can offload the authentication process to Keycloak and simplify the authentication flow for your 3rd party APIs.

Prerequisites

Before we begin, let's go over the prerequisites for this article. You will need the following:

• A running instance of Keycloak
• A 3rd party API that requires authentication
• A basic understanding of HTTP and reverse proxy concepts

Setting up Keycloak

The first step is to set up Keycloak. You can download the latest version of Keycloak from the Keycloak website. Once you have downloaded Keycloak, you can run it using the following command:

This will start Keycloak on port 8080 and make it accessible from any IP address. Once Keycloak is running, you can access the administration console by navigating to http://localhost:8080/auth/ in your web browser.

Creating a Realm

The next step is to create a realm in Keycloak. A realm is a separate and distinct environment for managing users, credentials, and roles. To create a realm, navigate to the administration console and click on the "Realms" tab. Then, click on the "Add realm" button.

In the "Add Realm" dialog, enter a name for your realm and click on the "Create" button. For this example, we will use the name "my-realm".

Creating a Client

The next step is to create a client in Keycloak. A client is a representation of an application or service that wants to access resources in a realm. To create a client, navigate to the "Clients" tab in the administration console and click on the "Create" button.

In the "Create" dialog, enter a name for your client and select the " confidential" client authentication method. Then, click on the "Save" button.

Once the client is created, you will be taken to the "Client Scopes" tab. Here, you can configure the client's access to various resources in the realm. For this example, we will not configure any client scopes.

Creating a User

The next step is to create a user in Keycloak. A user is a person or entity that can authenticate to a realm and access resources. To create a user, navigate to the "Users" tab in the administration console and click on the "Add user" button.

In the "Add User" dialog, enter a username and email address for the user and click on the "Save" button. Once the user is created, you will be taken to the user's details page.

On the user's details page, you can set the user's password and configure various other settings. For this example, we will set the user's password to "password" and leave the other settings at their default values.

Configuring the Reverse Proxy

The final step is to configure the reverse proxy. A reverse proxy is a server that sits in front of one or more application servers and forwards requests to the appropriate server based on various criteria. In this example, we will use Nginx as the reverse proxy.

To configure Nginx as a reverse proxy for Keycloak, you will need to edit the Nginx configuration file and add the following ``` server { listen 80; server_name api.example.com; location / { proxy_pass http://keycloak:8080/auth/realms/my-realm/protocol/openid-connect/auth?response_type=code&client_id=my-client&redirect_uri=http%3A%2F%2Fapi.example.com%2Fcallback&state=123456&nonce=789012; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /callback { proxy_pass http://keycloak:8080/auth/realms/my-realm/protocol/openid-connect/token; proxy_set_header Host $host; proxy_set_header Content-Type application/x-www-form-urlencoded; proxy_set_header Authorization "Basic YWRtaW46cGFzc3dvcmQ="; proxy_pass_request_body on; } } ```

This configuration will forward all requests to the api.example.com domain to Keycloak for authentication. The proxy_pass directive in the first location block specifies the URL for the Keycloak authentication endpoint. The proxy_pass directive in the second location block specifies the URL for the Keycloak token endpoint.

The proxy_set_header directives in both location blocks set various headers that are used by Keycloak to determine the client and user making the request. The proxy_pass_request_body directive in the second location block ensures that the request body is forwarded to the Keycloak token endpoint.

Testing the Setup

To test the setup, navigate to http://api.example.com in your web browser. You should be redirected to the Keycloak authentication page. Enter the username and password for the user you created earlier and click on the "Log In" button.

Once you have logged in, you will be redirected back to the 3rd party API. The API will now be authenticated using Keycloak and you can access its resources.

In this article, we have discussed how to use Keycloak as a reverse proxy for 3rd party API authentication. By using Keycloak as a reverse proxy, you can offload the authentication process to Keycloak and simplify the authentication flow for your 3rd party APIs. This can help you to improve the security and scalability of your applications and services.

References