Skip to content

Home

Jump to bottom
gennady73 edited this page Dec 3, 2025 · 3 revisions

Keycloak Demo Project: Legacy Workshop

This repository hosts a legacy, functional workshop guide for deploying and configuring Red Hat Single Sign-On (RH-SSO) / Keycloak (v7.6.x).

This project focuses on the foundational setup of a single-site, highly-available (HA) cluster and the integration of a simple application secured via OpenID Connect (OIDC).

NOTE: This project uses older Keycloak versions and serves as the conceptual predecessor to the RHBK Multi-Site SSO Workshop.

Workshop Structure

Use the sidebar navigation to follow the project chapters.

Chapter Focus Files Covered
I. Configuration Guide Installation, Core Server Settings, and Initial Client Setup. docs/keycloak/RHSSO_Configuration_Guide.md
II. Application Integration Step-by-step instructions for deploying and securing the test application. kc-front-end/README.md, kc-back-end/README.md
III. Advanced Topics Exploration of older cross-site (xsite) concepts and other advanced subjects. docs/xsite/README.md

NOTE: This project uses older Keycloak versions(up to v.18) and serves as the conceptual predecessor to the RHBK Multi-Site SSO Workshop.

I. Configuration Guide (RHSSO Administrator Context)

Terminology

Getting started

The workflows

  • Keycloak client types

  • The Keycloak Realm overview: relations between Roles, Groups, Users, and Cliens.

  • Workflow: Web application (Front-end)

    • Case: The front-end application and the back-end service.
      • Public client definition
    • Case: The frontend and several back-end services

  • Workflow: Machine to machine communication(M2M)

    • Confidential client overview.

    • Bearer-only client overview.

    • The Service account setup.

    • The M2M Interaction Closeup.

    • Case: The front-end and several back-end services.

      • Front-End: public client.
      • Back-end "service A": Bearer-only client.
      • Back-end "service B": Confidential client.

Oauth2 Proxy - The alternative (code-free) workflow.

  • Workflow: Web application with Front-end and/or Backend
  • Browser based flow explanation
  • Keycloak settings example
  • Oauth2 Proxy settings example

II. Developer Guide (Application Developer Context)

Terminology

Getting started

The workflows

  • Workflow: Web application (Front-end)

    • Case: The front-end application and the back-end service.
      • Frontend OIDC Integration, code closeup.
      • Backend API Security, code closeup.

  • Workflow: Machine to machine communication(M2M)

    • Case: application which consists of a front-end and several back-end services

    • Confidential client overview.

    • Bearer-only client overview.

    • The M2M Interaction Closeup.

    • The Service account

    • Keycloak API call delegation, code closeup.

    • Case: The front-end and several back-end services.

      • Front-End: public client.
      • Back-end "service A": Bearer-only client.
      • Back-end "service B": Confidential client.
      • Keycloak API call delegation: The "service account" vs "role overriding" approach, code closeup.

Oauth2 Proxy - The alternative (code-free) workflow.

  • Workflow: Web application with Front-end and/or Backend
  • Keycloak settings summary
  • Oauth2 Proxy settings summary

III. Red Hat Single Sign-On (RHSSO) High-Availability

This chapter explores advanced deployment scenarios for RH-SSO (Keycloak 7.6.x), focusing on clustering, resilience, and the architectural challenges of multi-site deployments.

Note: This content reflects legacy architectures. For modern, cloud-native HA, please refer to the RHBK Multi-Site SSO Workshop.

Introduction

Prerequisites

Configuration Management in Clustered Deployments

Discussing the risks of operating two separate clusters in Active-Active mode without synchronous replication.

Domain Mode

Understanding the requirements for a single, centralized relational database (PostgreSQL) shared by all cluster nodes to maintain data consistency.

High Availability (HA) Mode with External Infinispan and Shared PostgreSQL Database

High-Availability (HA) Mode with External Infinispan and Multi-Master MariaDB/Galera Cluster

An overview of database-level replication options (e.g., Galera) required to support a multi-site RH-SSO deployment.

Load Balancer Configuration

  • Build the HAProxy Image
  • Run the HAProxy Container

Realm Management

  • Export Realm Configuration
  • Import Realm Configuration

Infinispan

  • Prerequisites
  • Relations in deployment
  • Sites configurations
  • Network configuration

The Infinispan cross-site configuration - run

  • Cache configuration
  • Docker compose file
  • Storage
  • Run the cluster containers

Clone this wiki locally