keycloak

{
  "exp": 1705312800,
  "iat": 1705312500,
  "iss": "http://keycloak:8080/realms/csp", // Nguồn cội cấp phát
  "sub": "user-uuid-123", // Định danh duy nhất của User
  "typ": "Bearer",
  "azp": "csp-frontend", // Client nào đã xin token này
  "preferred_username": "john.doe",
  "email": "john@example.com",
 
  // Quyền hạn cấp toàn hệ thống (Realm)
  "realm_access": {
    "roles": ["user", "admin"]
  },
 
  // Quyền hạn cấp riêng biệt cho từng Client (Resource)
  "resource_access": {
    "order-service": {
      "roles": ["order_read", "order_write"]
    }
  }
}

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          # Spring Boot sẽ gọi đến điểm well-known (.well-known/openid-configuration)
          # để tự động lấy Public Keys (JWKS) dùng cho việc xác thực chữ ký token.
          issuer-uri: http://keycloak:8080/realms/csp

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {
 
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable()) // Stateless APIs không cần CSRF
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/health").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/api/**").authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt.jwtAuthenticationConverter(keycloakJwtConverter()))
            );
        return http.build();
    }
 
    private JwtAuthenticationConverter keycloakJwtConverter() {
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(jwt -> {
            List<GrantedAuthority> authorities = new ArrayList<>();
 
            // 1. Phân tách các Realm Roles
            Map<String, Object> realmAccess = jwt.getClaimAsMap("realm_access");
            if (realmAccess != null) {
                List<String> roles = (List<String>) realmAccess.get("roles");
                roles.forEach(role ->
                    authorities.add(new SimpleGrantedAuthority("ROLE_" + role.toUpperCase())));
            }
 
            // 2. Phân tách các Client Roles (Tùy chọn cho độ mịn cao hơn)
            Map<String, Object> resourceAccess = jwt.getClaimAsMap("resource_access");
            if (resourceAccess != null) {
                Map<String, Object> clientAccess = (Map<String, Object>) resourceAccess.get("order-service");
                if (clientAccess != null) {
                    List<String> clientRoles = (List<String>) clientAccess.get("roles");
                    clientRoles.forEach(role ->
                        authorities.add(new SimpleGrantedAuthority(role)));
                }
            }
 
            return authorities;
        });
        return converter;
    }
}

@Service
public class KeycloakAdminService {
 
   private final Keycloak keycloak;
 
   public KeycloakAdminService(@Value("${keycloak.admin.url}") String url,
                                @Value("${keycloak.admin.realm}") String realm,
                                @Value("${keycloak.admin.client-id}") String clientId,
                                @Value("${keycloak.admin.client-secret}") String secret) {
       this.keycloak = KeycloakBuilder.builder()
           .serverUrl(url)
           .realm(realm)
           .clientId(clientId)
           .clientSecret(secret)
           .grantType(OAuth2Constants.CLIENT_CREDENTIALS)
           .build();
   }
 
   // Create user
   public String createUser(String realm, String username, String email, String password) {
       UserRepresentation user = new UserRepresentation();
       user.setUsername(username);
       user.setEmail(email);
       user.setEnabled(true);
       user.setEmailVerified(true);
 
       CredentialRepresentation credential = new CredentialRepresentation();
       credential.setType(CredentialRepresentation.PASSWORD);
       credential.setValue(password);
       credential.setTemporary(false);
       user.setCredentials(List.of(credential));
 
       Response response = keycloak.realm(realm).users().create(user);
       String userId = CreatedResponseUtil.getCreatedId(response);
       return userId;
   }
 
   // Assign role to user
   public void assignRole(String realm, String userId, String roleName) {
       RoleRepresentation role = keycloak.realm(realm).roles().get(roleName).toRepresentation();
       keycloak.realm(realm).users().get(userId).roles().realmLevel()
           .add(List.of(role));
   }
 
   // Get user by email
   public UserRepresentation getUserByEmail(String realm, String email) {
       List<UserRepresentation> users = keycloak.realm(realm).users()
           .searchByEmail(email, true);
       return users.isEmpty() ? null : users.get(0);
   }
 
   // Disable user
   public void disableUser(String realm, String userId) {
       UserRepresentation user = keycloak.realm(realm).users().get(userId).toRepresentation();
       user.setEnabled(false);
       keycloak.realm(realm).users().get(userId).update(user);
   }
}

{
  "clientId": "order-service",
  "protocol": "openid-connect",
  "publicClient": false,
  "serviceAccountsEnabled": true,
  "authorizationServicesEnabled": false,
  "directAccessGrantsEnabled": false,
  "standardFlowEnabled": false,
  "clientAuthenticatorType": "client-secret"
}

{
  "clientId": "csp-frontend",
  "protocol": "openid-connect",
  "publicClient": true,
  "standardFlowEnabled": true,
  "directAccessGrantsEnabled": false,
  "redirectUris": ["http://localhost:3000/*", "https://app.example.com/*"],
  "webOrigins": ["http://localhost:3000", "https://app.example.com"]
}

{
  "sub": "user-123",
  "workspace_id": "ws-abc",
  "realm_access": { "roles": ["user"] }
}

// Service A calls Service B using client credentials
@Service
public class ServiceBClient {
 
   private final WebClient webClient;
   private final OAuth2AuthorizedClientManager clientManager;
 
   public Object callServiceB() {
       // Auto-fetches token using client credentials
       return webClient.get()
           .uri("http://service-b/api/data")
           .attributes(clientRegistrationId("service-b"))
           .retrieve()
           .bodyToMono(Object.class)
           .block();
   }
}

public String getServiceToken() {
   MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
   params.add("grant_type", "client_credentials");
   params.add("client_id", clientId);
   params.add("client_secret", clientSecret);
 
   TokenResponse response = restTemplate.postForObject(
       keycloakUrl + "/realms/csp/protocol/openid-connect/token",
       params, TokenResponse.class);
 
   return response.getAccessToken();
}

public class CustomEventListener implements EventListenerProvider {
 
    @Override
    public void onEvent(Event event) {
        if (event.getType() == EventType.LOGIN) {
            log.info("Xác thực thành công | userId={} | ip={}",
                event.getUserId(), event.getIpAddress());
        }
        if (event.getType() == EventType.LOGIN_ERROR) {
            log.warn("Cảnh báo bất thường: Thất bại xác thực | userId={} | error={}",
                event.getUserId(), event.getError());
            // Có thể emit event ra Kafka để hệ thống Fraud Detection xử lý
        }
    }
 
    @Override
    public void onEvent(AdminEvent event, boolean includeRepresentation) {
        // Lắng nghe các thay đổi về cấu hình từ Admin
    }
}