keycloak với spring boot

{
  "exp": 1705312800,
  "iat": 1705312500,
  "iss": "http://keycloak:8080/realms/csp", // Nguồn cội cấp phát
  "sub": "user-uuid-123", // Định danh duy nhất của User
  "typ": "Bearer",
  "azp": "csp-frontend", // Client nào đã xin token này
  "preferred_username": "john.doe",
  "email": "john@example.com",
 
  // Quyền hạn cấp toàn hệ thống (Realm)
  "realm_access": {
    "roles": ["user", "admin"]
  },
 
  // Quyền hạn cấp riêng biệt cho từng Client (Resource)
  "resource_access": {
    "order-service": {
      "roles": ["order_read", "order_write"]
    }
  }
}

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          # Spring Boot sẽ gọi đến điểm well-known (.well-known/openid-configuration)
          # để tự động lấy Public Keys (JWKS) dùng cho việc xác thực chữ ký token.
          issuer-uri: http://keycloak:8080/realms/csp

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {
 
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable()) // Stateless APIs không cần CSRF
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/health").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/api/**").authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt.jwtAuthenticationConverter(keycloakJwtConverter()))
            );
        return http.build();
    }
 
    private JwtAuthenticationConverter keycloakJwtConverter() {
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(jwt -> {
            List<GrantedAuthority> authorities = new ArrayList<>();
 
            // 1. Phân tách các Realm Roles
            Map<String, Object> realmAccess = jwt.getClaimAsMap("realm_access");
            if (realmAccess != null) {
                List<String> roles = (List<String>) realmAccess.get("roles");
                roles.forEach(role ->
                    authorities.add(new SimpleGrantedAuthority("ROLE_" + role.toUpperCase())));
            }
 
            // 2. Phân tách các Client Roles (Tùy chọn cho độ mịn cao hơn)
            Map<String, Object> resourceAccess = jwt.getClaimAsMap("resource_access");
            if (resourceAccess != null) {
                Map<String, Object> clientAccess = (Map<String, Object>) resourceAccess.get("order-service");
                if (clientAccess != null) {
                    List<String> clientRoles = (List<String>) clientAccess.get("roles");
                    clientRoles.forEach(role ->
                        authorities.add(new SimpleGrantedAuthority(role)));
                }
            }
 
            return authorities;
        });
        return converter;
    }
}

@Service
public class KeycloakAdminService {
 
   private final Keycloak keycloak;
 
   public KeycloakAdminService(@Value("${keycloak.admin.url}") String url,
                                @Value("${keycloak.admin.realm}") String realm,
                                @Value("${keycloak.admin.client-id}") String clientId,
                                @Value("${keycloak.admin.client-secret}") String secret) {
       this.keycloak = KeycloakBuilder.builder()
           .serverUrl(url)
           .realm(realm)
           .clientId(clientId)
           .clientSecret(secret)
           .grantType(OAuth2Constants.CLIENT_CREDENTIALS)
           .build();
   }
 
   // Create user
   public String createUser(String realm, String username, String email, String password) {
       UserRepresentation user = new UserRepresentation();
       user.setUsername(username);
       user.setEmail(email);
       user.setEnabled(true);
       user.setEmailVerified(true);
 
       CredentialRepresentation credential = new CredentialRepresentation();
       credential.setType(CredentialRepresentation.PASSWORD);
       credential.setValue(password);
       credential.setTemporary(false);
       user.setCredentials(List.of(credential));
 
       // Response giữ HTTP connection, phải đóng sau khi dùng
       try (Response response = keycloak.realm(realm).users().create(user)) {
           // getCreatedId ném WebApplicationException nếu status khác 201 (vd 409 trùng username/email)
           return CreatedResponseUtil.getCreatedId(response);
       }
   }
 
   // Assign role to user
   public void assignRole(String realm, String userId, String roleName) {
       RoleRepresentation role = keycloak.realm(realm).roles().get(roleName).toRepresentation();
       keycloak.realm(realm).users().get(userId).roles().realmLevel()
           .add(List.of(role));
   }
 
   // Get user by email
   public UserRepresentation getUserByEmail(String realm, String email) {
       List<UserRepresentation> users = keycloak.realm(realm).users()
           .searchByEmail(email, true);
       return users.isEmpty() ? null : users.get(0);
   }
 
   // Disable user
   public void disableUser(String realm, String userId) {
       UserRepresentation user = keycloak.realm(realm).users().get(userId).toRepresentation();
       user.setEnabled(false);
       keycloak.realm(realm).users().get(userId).update(user);
   }
}

{
  "clientId": "order-service",
  "protocol": "openid-connect",
  "publicClient": false,
  "serviceAccountsEnabled": true,
  "authorizationServicesEnabled": false,
  "directAccessGrantsEnabled": false,
  "standardFlowEnabled": false,
  "clientAuthenticatorType": "client-secret"
}

{
  "clientId": "csp-frontend",
  "protocol": "openid-connect",
  "publicClient": true,
  "standardFlowEnabled": true,
  "directAccessGrantsEnabled": false,
  "redirectUris": ["http://localhost:3000/*", "https://app.example.com/*"],
  "webOrigins": ["http://localhost:3000", "https://app.example.com"],
  "attributes": {
    "pkce.code.challenge.method": "S256"
  }
}

spring:
  security:
    oauth2:
      client:
        registration:
          service-b:
            provider: keycloak
            client-id: order-service
            client-secret: ${ORDER_SERVICE_SECRET}
            authorization-grant-type: client_credentials
        provider:
          keycloak:
            issuer-uri: http://keycloak:8080/realms/csp

@Configuration
public class OAuth2ClientConfig {
 
   // Manager chạy được cả ngoài HTTP request (scheduled job, consumer...)
   @Bean
   public OAuth2AuthorizedClientManager authorizedClientManager(
           ClientRegistrationRepository registrations,
           OAuth2AuthorizedClientService clientService) {
       var manager = new AuthorizedClientServiceOAuth2AuthorizedClientManager(registrations, clientService);
       manager.setAuthorizedClientProvider(
           OAuth2AuthorizedClientProviderBuilder.builder().clientCredentials().build());
       return manager;
   }
 
   @Bean
   public WebClient webClient(OAuth2AuthorizedClientManager manager) {
       var oauth2 = new ServletOAuth2AuthorizedClientExchangeFilterFunction(manager);
       return WebClient.builder()
           .apply(oauth2.oauth2Configuration())
           .build();
   }
}

// Service A calls Service B using client credentials
// import static ...ServletOAuth2AuthorizedClientExchangeFilterFunction.clientRegistrationId;
@Service
public class ServiceBClient {
 
   private final WebClient webClient;
 
   public ServiceBClient(WebClient webClient) {
       this.webClient = webClient;
   }
 
   public Object callServiceB() {
       // Filter tự lấy token bằng client credentials, cache lại và chỉ xin token mới khi sắp hết hạn
       return webClient.get()
           .uri("http://service-b/api/data")
           .attributes(clientRegistrationId("service-b"))
           .retrieve()
           .bodyToMono(Object.class)
           .block();
   }
}

record TokenResponse(@JsonProperty("access_token") String accessToken,
                     @JsonProperty("expires_in") long expiresIn) {}
 
public String getServiceToken() {
   MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
   params.add("grant_type", "client_credentials");
   params.add("client_id", clientId);
   params.add("client_secret", clientSecret);
 
   // MultiValueMap được gửi dạng application/x-www-form-urlencoded, đúng định dạng token endpoint yêu cầu
   TokenResponse response = restTemplate.postForObject(
       keycloakUrl + "/realms/csp/protocol/openid-connect/token",
       params, TokenResponse.class);
 
   return response.accessToken();
}

public class CustomEventListener implements EventListenerProvider {
 
    private static final Logger log = Logger.getLogger(CustomEventListener.class); // org.jboss.logging
 
    @Override
    public void onEvent(Event event) {
        if (event.getType() == EventType.LOGIN) {
            log.infof("Xác thực thành công | userId=%s | ip=%s",
                event.getUserId(), event.getIpAddress());
        }
        if (event.getType() == EventType.LOGIN_ERROR) {
            log.warnf("Cảnh báo bất thường: Thất bại xác thực | userId=%s | error=%s",
                event.getUserId(), event.getError());
            // Có thể emit event ra Kafka để hệ thống Fraud Detection xử lý
        }
    }
 
    @Override
    public void onEvent(AdminEvent event, boolean includeRepresentation) {
        // Lắng nghe các thay đổi về cấu hình từ Admin
    }
 
    @Override
    public void close() {
        // Bắt buộc theo interface Provider; giải phóng tài nguyên nếu có
    }
}

public class CustomEventListenerFactory implements EventListenerProviderFactory {
 
    @Override
    public EventListenerProvider create(KeycloakSession session) {
        return new CustomEventListener();
    }
 
    @Override
    public String getId() {
        return "custom-event-listener"; // tên hiện trong Realm settings > Events
    }
 
    @Override public void init(Config.Scope config) {}
    @Override public void postInit(KeycloakSessionFactory factory) {}
    @Override public void close() {}
}