{"id":34786362,"url":"https://github.com/deepaksorthiya/spring-boot-keycloak-authorization","last_synced_at":"2026-04-24T17:03:47.146Z","repository":{"id":285141608,"uuid":"957186994","full_name":"deepaksorthiya/spring-boot-keycloak-authorization","owner":"deepaksorthiya","description":"Spring Boot Security Keycloak Policy ABAC Authorization","archived":false,"fork":false,"pushed_at":"2026-04-10T05:04:38.000Z","size":90,"stargazers_count":0,"open_issues_count":8,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-04-10T07:15:51.131Z","etag":null,"topics":["abac","access-control","policy","security","spring-boot","spring-security"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/deepaksorthiya.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-03-29T18:58:54.000Z","updated_at":"2026-04-10T05:04:36.000Z","dependencies_parsed_at":null,"dependency_job_id":"91647655-0562-40b9-a0e0-f84d2a43e353","html_url":"https://github.com/deepaksorthiya/spring-boot-keycloak-authorization","commit_stats":null,"previous_names":["deepaksorthiya/spring-boot-3-keycloak-authorization","deepaksorthiya/spring-boot-keycloak-authorization"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/deepaksorthiya/spring-boot-keycloak-authorization","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deepaksorthiya%2Fspring-boot-keycloak-authorization","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deepaksorthiya%2Fspring-boot-keycloak-authorization/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deepaksorthiya%2Fspring-boot-keycloak-authorization/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deepaksorthiya%2Fspring-boot-keycloak-authorization/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/deepaksorthiya","download_url":"https://codeload.github.com/deepaksorthiya/spring-boot-keycloak-authorization/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deepaksorthiya%2Fspring-boot-keycloak-authorization/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32232633,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-24T13:21:15.438Z","status":"ssl_error","status_checked_at":"2026-04-24T13:21:15.005Z","response_time":64,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["abac","access-control","policy","security","spring-boot","spring-security"],"created_at":"2025-12-25T09:21:31.257Z","updated_at":"2026-04-24T17:03:47.139Z","avatar_url":"https://github.com/deepaksorthiya.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Java Maven Build Test](https://github.com/deepaksorthiya/spring-boot-keycloak-authorization/actions/workflows/maven-build.yml/badge.svg)](https://github.com/deepaksorthiya/spring-boot-keycloak-authorization/actions/workflows/maven-build.yml)\n[![Docker Hub badge][dockerhub-badge]][dockerhub]\n\n[dockerhub-badge]: https://img.shields.io/docker/pulls/deepaksorthiya/spring-boot-keycloak-authorization\n\n[dockerhub]: https://hub.docker.com/repository/docker/deepaksorthiya/spring-boot-keycloak-authorization\n\n---\n\n### ** Spring Boot Security Keycloak Policy ABAC Authorization **\n\n---\n\n# Getting Started\n\n### Requirements:\n\n```\nGit: 2.51+\nSpring Boot: 4.0.2\nMaven: 3.9+\nJava: 25\nDocker Desktop: Tested on 4.50.0\nKeycloak: 26.5+\n```\n\n### Clone this repository:\n\n```bash\ngit clone https://github.com/deepaksorthiya/spring-boot-keycloak-authorization.git\ncd spring-boot-keycloak-authorization\n```\n\n### Build Project:\n\n```bash\n./mvnw clean package\n```\n\n### Start Keycloak Server Using Docker:\n\n```bash\ndocker compose up\n```\n\n### Run Project:\n\n```bash\n./mvnw spring-boot:run\n```\n\nOR\n\n```bash\njava -jar .\\target\\spring-boot-keycloak-authorization-0.0.1-SNAPSHOT.jar\n```\n\n## Run using Docker(Optional):\n\n### Build Docker Image(docker should be running):\n\n```bash\n./mvnw clean spring-boot:build-image -DskipTests\n```\n\nOR\n\n```bash\ndocker build -t deepaksorthiya/spring-boot-keycloak-authorization:0.0.1-SNAPSHOT . \n```\n\n### Run Using Docker\n\n```bash\ndocker run --name spring-boot-keycloak-authorization -p 8080:8080 deepaksorthiya/spring-boot-keycloak-authorization:0.0.1-SNAPSHOT\n```\n\n### Testing\n\nThere are 2 endpoints exposed by the service:\n\n* http://localhost:8080/ - can be invoked by any authenticated user\n* http://localhost:8080/protected/premium - can be invoked by users with the `user_premium` role\n\nTo invoke the protected endpoints using a bearer token, your client needs to obtain an OAuth2 access token from a\nKeycloak server.\nIn this example, we are going to obtain tokens using the resource owner password grant type so that the client can act\non behalf of any user available from\nthe realm.\n\nYou should be able to obtain tokens for any of these users:\n\n| Username | Password | Roles        |\n|----------|----------|--------------|\n| jdoe     | jdoe     | user_premium |\n| alice    | alice    | user         |\n\nTo obtain the bearer token, run for instance the following command when on Linux (please make sure to have `curl` and\n`jq` packages available in your linux distribution):\n\n```bash\ncurl -X POST http://localhost:8180/realms/quickstart/protocol/openid-connect/token \\\n-H 'content-type: application/x-www-form-urlencoded' \\\n-d 'client_id=authz-servlet\u0026client_secret=secret' \\\n-d 'username=jdoe\u0026password=jdoe\u0026grant_type=password' | jq --raw-output '.access_token'\n```\n\nYou can use the same command to obtain tokens on behalf of user `alice`, just make sure to change both `username` and\n`password` request parameters.\n\nAfter running the command above, you can now access the `http://localhost:8080/protected/premium` endpoint\nbecause the user `jdoe` has the `user_premium` role.\n\n```shell\ncurl http://localhost:8080/protected/premium \\\n  -H \"Authorization: Bearer \"$access_token\n```\n\nAs a result, you will see the following response from the service:\n\n```\nHello, jdoe!\n```\n\nAccessing Protected Resources using Requesting Party Token (RPT)\n---------------------\n\nAnother approach to access resources protected by a policy enforcer is using a RPT as a bearer token, instead of a\nregular access token.\nThe RPT is an access token with all permissions granted by the server, basically, an access token containing all\npermissions granted by the server.\n\nTo obtain an RPT, you must first exchange an OAuth2 Access Token for a RPT by invoking the token endpoint at the\nKeycloak server:\n\n```bash\nexport rpt=$(curl -X POST \\\n http://localhost:8180/realms/quickstart/protocol/openid-connect/token \\\n -H \"Authorization: Bearer \"$access_token \\\n --data \"grant_type=urn:ietf:params:oauth:grant-type:uma-ticket\" \\\n --data \"audience=authz-servlet\" \\\n  --data \"permission=Premium Resource\" | jq --raw-output '.access_token' \\\n )\n```\n\nThe command above is trying to obtain permissions from the server in the format of a RPT. Note that the request is\nspecifying the resource we want\nto obtain permissions, in this case, `Premium Resource`.\n\nAs an alternative, you can also obtain permissions for any resource protected by your application. For that, execute the\ncommand below:\n\n```bash\nexport rpt=$(curl -X POST \\\n http://localhost:8180/realms/quickstart/protocol/openid-connect/token \\\n -H \"Authorization: Bearer \"$access_token \\\n --data \"grant_type=urn:ietf:params:oauth:grant-type:uma-ticket\" \\\n --data \"audience=authz-servlet\" | jq --raw-output '.access_token' \\\n )\n```\n\nAfter executing any of the commands above, you should get a response similar to the following:\n\n```bash\n{\n    \"access_token\": \"${rpt}\",\n}\n``` \n\nTo finally invoke the resource protected by the application, replace the ``${rpt}`` variable below with the value of the\n``access_token`` claim from the response above and execute the following command:\n\n```bash\ncurl http://localhost:8080/protected/premium \\\n    -H \"Authorization: Bearer ${rpt}\"\n```\n\n### Reference Documentation\n\nFor further reference, please consider the following sections:\n\n* [Official Apache Maven documentation](https://maven.apache.org/guides/index.html)\n* [Spring Boot Maven Plugin Reference Guide](https://docs.spring.io/spring-boot/3.4.3/maven-plugin)\n* [Create an OCI image](https://docs.spring.io/spring-boot/3.4.3/maven-plugin/build-image.html)\n* [Spring Web](https://docs.spring.io/spring-boot/3.4.3/reference/web/servlet.html)\n* [Spring Security](https://docs.spring.io/spring-boot/3.4.3/reference/web/spring-security.html)\n* [OAuth2 Resource Server](https://docs.spring.io/spring-boot/3.4.3/reference/web/spring-security.html#web.security.oauth2.server)\n\n### Guides\n\nThe following guides illustrate how to use some features concretely:\n\n* [Building a RESTful Web Service](https://spring.io/guides/gs/rest-service/)\n* [Serving Web Content with Spring MVC](https://spring.io/guides/gs/serving-web-content/)\n* [Building REST services with Spring](https://spring.io/guides/tutorials/rest/)\n* [Securing a Web Application](https://spring.io/guides/gs/securing-web/)\n* [Spring Boot and OAuth2](https://spring.io/guides/tutorials/spring-boot-oauth2/)\n* [Authenticating a User with LDAP](https://spring.io/guides/gs/authenticating-ldap/)\n\n### Maven Parent overrides\n\nDue to Maven's design, elements are inherited from the parent POM to the project POM.\nWhile most of the inheritance is fine, it also inherits unwanted elements like `\u003clicense\u003e` and `\u003cdevelopers\u003e` from the\nparent.\nTo prevent this, the project POM contains empty overrides for these elements.\nIf you manually switch to a different parent and actually want the inheritance, you need to remove those overrides.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeepaksorthiya%2Fspring-boot-keycloak-authorization","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdeepaksorthiya%2Fspring-boot-keycloak-authorization","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeepaksorthiya%2Fspring-boot-keycloak-authorization/lists"}