{"id":22945336,"url":"https://github.com/sesaquecruz/auth-infrastructure","last_synced_at":"2025-09-07T17:35:05.222Z","repository":{"id":171131633,"uuid":"644620934","full_name":"sesaquecruz/auth-infrastructure","owner":"sesaquecruz","description":"A Secure Infrastructure with Apache APISIX and Keycloak.","archived":false,"fork":false,"pushed_at":"2023-06-01T16:28:02.000Z","size":105,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-06-12T19:07:26.029Z","etag":null,"topics":["api-gateway","apisix","iam","keycloak","oauth2","oidc"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sesaquecruz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-05-23T22:59:44.000Z","updated_at":"2024-03-25T16:06:09.000Z","dependencies_parsed_at":null,"dependency_job_id":"d8d5fba3-d887-40f2-ae8e-12a6ef0ade8b","html_url":"https://github.com/sesaquecruz/auth-infrastructure","commit_stats":null,"previous_names":["sesaquecruz/auth-infrastructure"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/sesaquecruz/auth-infrastructure","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sesaquecruz%2Fauth-infrastructure","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sesaquecruz%2Fauth-infrastructure/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sesaquecruz%2Fauth-infrastructure/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sesaquecruz%2Fauth-infrastructure/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sesaquecruz","download_url":"https://codeload.github.com/sesaquecruz/auth-infrastructure/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sesaquecruz%2Fauth-infrastructure/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274069747,"owners_count":25217188,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-07T02:00:09.463Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api-gateway","apisix","iam","keycloak","oauth2","oidc"],"created_at":"2024-12-14T14:31:17.576Z","updated_at":"2025-09-07T17:35:05.058Z","avatar_url":"https://github.com/sesaquecruz.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Auth Infrastructure\n\nThis project showcases a secure infrastructure that utilizes the **Apache APISIX (API Gateway)** and the **Keycloak (IAM)** to protect API endpoints. The authentication and authorization methods employed are **OIDC** and **OAuth 2.0**, respectively.\n\n## Overview\n\nThis project contains two services, both of them are replicated across two nodes. Through the API Gateway, each service is associated to one route. The public service is associated to `(\"/\")` and the protected service to `(\"/api/\")`. \n\nUsers attempting to access the protected route are redirected to the login page to perform authentication. They also have the option to create a new account. After successful authentication, the user is redirected to the protected endpoint and granted access. The endpoints responses body contains messages indicating whether they are public or private and the node accessed.\n\n- Infrastructure:\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"./images/api-gateway-flow.png\" /\u003e\n\u003c/p\u003e\n\n- Authentication and Authorization Flow:\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"./images/oidc-flow.png\" /\u003e\n\u003c/p\u003e\n\n## Requirements\n\n- Docker\n- Docker Compose\n- A stable internet connection\n\n## Installation\n\n1. Clone this repository:\n\n```\ngit clone https://github.com/sesaquecruz/auth-infrastructure.git\n```\n\n2. Enter the project directory:\n\n```\ncd auth-infrastructure\n```\n\n3. Start the containers (Keycloak can take about a minute to start.):\n\n```\ndocker compose up -d\n```\n\n## Usage\n\nEndpoints:\n\n- Keycloak:\n\nAs an example of organization, the realm created was named bank. \n\nPlease see the Troubleshooting section to understand why the `keycloak` domain needs to be used and how to set it.\n\n```\nhttp://keycloak:8080/realms/bank/account/\n```\n\n- Public Service:\n\n```\nhttp://127.0.0.1:9080/\n```\n\n- Protected Service:\n\n```\nhttp://127.0.0.1:9080/api/\n```\n\n## Troubleshooting:\n\n\nAs the containers run inside a Docker network, they are accessed using service names. So, for APISIX to connect to Keycloak, it needs to receive something like `http://keycloak:8080`, as shown below in the OIDC plugin configuration:\n\n```\n\"openid-connect\":{\n\t\"client_id\":\"bank-api\",\n\t\"client_secret\":\"kZ9TTjOtalbwWdcJYmu3Hy8CfZQ9xnmD\",\n\t\"discovery\":\"http://keycloak:8080/realms/bank/.well-known/openid-configuration\",\n\t\"introspection_endpoint_auth_method\":\"client_secret_post\",\n\t\"realm\":\"bank\",\n\t\"redirect_uri\":\"http://127.0.0.1:9080/api/auth/\",\n\t\"scope\":\"openid profile\"\n}\n```\n\nThe result is that when the user is redirected to the authentication page, the domain 'keycloak' is not achieved.\n\nIt is fixed creating an alias to the local address `127.0.0.1` named `keycloak`. That can be done by adding the following line to the file `/etc/hosts`:\n\n```\n127.0.0.1\tkeycloak\n```\n\n## Cleanup\n\n1. To stop and remove the containers, run:\n\n```\ndocker compose down\n```\n\n## Keycloak Configuration\n\nThe Keycloak instance is preconfigured with an realm and client settings. These settings can be modified by updating the [realm config file](config/keycloak/bank-realm.json).\n\n## APISIX Configuration\n\nThe APISIX configurations, admin credentials, and etcd configurations can be found in the [config file](./config/apisix/config.yaml). The upstreams, services, and routes are created by a helper container executing the [script](./config/apisix/config.sh) that uses the APISIX Admin REST API to create them.\n\n## Contributing\n\nContributions to this project are welcome. If you encounter any issues or have ideas for enhancements, feel free to open an issue or submit a pull request.\n\n## License\n\nThis project is licensed under the MIT License. Please see the [LICENSE](./LICENSE) file for more details.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsesaquecruz%2Fauth-infrastructure","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsesaquecruz%2Fauth-infrastructure","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsesaquecruz%2Fauth-infrastructure/lists"}