Further episodes planned?

[norricorp]

Hi Thomas,
Do you have plans to add spring security to your demo with keycloak?
Regards
John

[ThomasVitale]

Hi @norricorp,
thanks for asking. Right now I'm updating the extisting articles after the release of Keycloak 7.
Then, in the next 2-3 weeks I'm going to publish a few more articles about Keycloak clients and how to configure them to use the different OAuth 2.0 flows. After that, I will finally get to talk about using Keycloak with Spring Security.
Thanks for your patience.

Best,
Thomas

[norricorp]

Hi Thomas, with regard to keycloak, have you used the "register user" facility. You can set the client to show a register link on the login page and that will lead to a register page. I have tried this and in my opinion there are a few problems. It does not set the role so though the user is added to keycloak, he is not allowed access to the application because no role is associated with that user. At the same time, keycloak thinks he is logged in. There is a workaround of setting a default role but I think that is a little untidy. Secondly, as well as assigning a role, it would be useful to be able to add that user to the applications database tables. So what seems sensible to me is that keycloak should return to a specified endpoint in the application so that extra housekeeping can be done. I have spoken to someone at Red Hat on the forum and apparently no one has ever asked for it. It has been suggested that I write an event listener module for keycloak that would listen for register and then do something like call application/endpoint. So I wondered if you had used this feature? Regards, John

…

------ Original Message ------ From: "Thomas Vitale" <[email protected]> To: "ThomasVitale/spring-keycloak-tutorials" <[email protected]> Cc: "norricorp" <[email protected]>; "Mention" <[email protected]> Sent: 25/08/2019 19:58:02 Subject: Re: [ThomasVitale/spring-keycloak-tutorials] Further episodes planned? (#1)

Hi @norricorp <https://github.com/norricorp>, thanks for asking. Right now I'm updating the extisting articles after the release of Keycloak 7. Then, in the next 2-3 weeks I'm going to publish a few more articles about Keycloak clients and how to configure them to use the different OAuth 2.0 flows. After that, I will finally get to talk about using Keycloak with Spring Security. Thanks for your patience. Best, Thomas — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1?email_source=notifications&email_token=AEUBLYIGOC2EDHJRKYVNXS3QGLI3VA5CNFSM4IONTFIKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD5CZTWQ#issuecomment-524655066>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AEUBLYJBJYV5K4L7FH3JRGDQGLI3VANCNFSM4IONTFIA>.

[ThomasVitale]

Hi @norricorp,
eventually I got to publish the article about Spring Security: Spring Security and Keycloak to Secure a Spring Boot Application.

About your question: I think there are different ways to achieve the customization you need.

For some scenarios it might be enough to have a default role assigned automatically to new users.

In some other cases, you might want to customize the registration flow and the registration form.

If you need an even higher degree of control, then you might want to leverage the Keycloak Admin REST API. So, you would implement your own registration logic in your application server and contact Keycloak by using the REST API to perform the actions required by your logic. The API documentation covers all the features offered by the API.

[norricorp]

Hi Thomas,
thanks for this. I decided that with regard to registration I think it is better to handle registration myself, then I can update the apps internal files as well as update keycloak.
Out of interest have you used keycloak with csrf. I am trying to get curl to work with both. I can get the oauth2 token and the csrf token but the latter is not appearing in the cookie file.
Regards,
John