Evaluating Client Permissions in Keycloak: A Guide to Building User-Friendly Extensions
Keycloak is an open-source identity and access management solution that provides a wide range of features to help manage security and authentication for your applications. In this article, we will explore how to build a Keycloak extension that allows users to create API keys, and how to evaluate permissions for users with a similar UI to the Keycloak Admin console, specifically under the client > authorization > Evaluate section.
What are Keycloak Extensions?
Keycloak extensions are a powerful tool that allows you to add new features and functionalities to the Keycloak platform. With extensions, you can customize the Keycloak Admin console, add new providers, or even change the way Keycloak works under the hood. There are two types of extensions: spi (Service Provider Interface) and protocol (OpenID Connect and OAuth 2.0). In this guide, we will focus on creating an spi extension.
Building a Keycloak Extension to Create API Keys
To build a Keycloak extension that allows users to create API keys, you will need to create a new spi extension and implement the RealmResourceProvider interface. This interface allows you to add new endpoints to the Keycloak Admin console, which can be used to create and manage API keys.
@Extension
public class ApiKeyExtension implements RealmResourceProvider {
private static final Logger logger = LoggerFactory.getLogger(ApiKeyExtension.class);
private final KeycloakSession session;
public ApiKeyExtension(KeycloakSession session) {
this.session = session;
}
@Override
public RealmResource getResource() {
return this;
}
@GET
@Path("/api-keys")
@RolesAllowed("realm-admin")
public List getApiKeys() {
// Implementation here
}
@POST
@Path("/api-keys")
@RolesAllowed("realm-admin")
public ApiKeyRepresentation createApiKey() {
// Implementation here
}
}
In the code above, we've created a new extension called ApiKeyExtension, which implements the RealmResourceProvider interface. We've also added two new endpoints, /api-keys and /api-keys, which can be used to get and create API keys. The @RolesAllowed("realm-admin") annotation ensures that only users with the "realm-admin" role can access these endpoints.
Evaluating Client Permissions
To evaluate client permissions in a similar UI to the Keycloak Admin console, you can create a new HTML template that mimics the client > authorization > Evaluate section. This template can be used to display the permissions for a selected client, and can be accessed through a new endpoint in your extension.
@GET
@Path("/client-permissions")
@RolesAllowed("realm-admin")
public Response getClientPermissions() {
// Render the HTML template here
}
In the code above, we've added a new endpoint, /client-permissions, which can be used to display the client permissions template. The @RolesAllowed("realm-admin") annotation ensures that only users with the "realm-admin" role can access this endpoint.
Building Keycloak extensions is a powerful way to customize and enhance the Keycloak platform. In this guide, we've explored how to create a Keycloak extension that allows users to create API keys, and how to evaluate client permissions with a similar UI to the Keycloak Admin console. With these skills, you can create your own extensions and contribute to the Keycloak community.
References
-
Keycloak Documentation: Extensions
-
Keycloak Documentation: Realm Resource Provider
-
Keycloak Documentation: The Template Engine
-
Keycloak Examples: Keycloak Examples