Keycloak

A ready-made authorization server instead of a hand-rolled one: single sign-on, OAuth2/OIDC, user and role management. The section takes you from "what is this" to integration with Spring and the finer points of tokens.

1. What Keycloak is — In plain terms: why you need Keycloak, what it takes on — single sign-on (SSO), OAuth2/OIDC, user and role management, social login — and when it is overkill.
2. OAuth2 and OIDC — In plain terms: the OAuth2 roles by an everyday analogy, why you need the access, refresh and ID tokens, how OAuth2 (access) differs from OIDC (who you are), what scopes are, and how the Authorization Code Flow works in broad strokes.
3. Realm, client, roles — The Keycloak model from scratch: the realm as an isolated space, the client (public vs confidential), users, realm roles vs client roles, groups, and how roles get into the token.
4. The Authorization Code Flow — Step by step, how the Authorization Code Flow works in Keycloak: redirect to login, the code, exchanging the code for tokens. Why PKCE is needed for SPAs and mobile, why the implicit flow is deprecated, and where to store tokens.
5. Spring Security — How to connect Spring Boot to Keycloak as an OAuth2 Resource Server: the starter, issuer-uri and jwk-set-uri, local JWT verification via JWKS, the SecurityFilterChain, and reading claims from the token.
6. Roles and access (RBAC/ABAC) — How roles from a Keycloak token become permissions: mapping realm and client roles to GrantedAuthority via JwtAuthenticationConverter, the difference between RBAC and ABAC, and the mistakes with the ROLE_ prefix.
7. Tokens and pitfalls — In plain terms: what a JWT is made of, how a service verifies the signature via JWKS when keys rotate, why you need a refresh token, how logout and session revocation work, and where people most often go wrong.