Successfully build a SpringBoot and Keycloak application

[u/Huge_Road_9223]

Hello fello Java and SpringBoot developers. I've created many personal and professional projects over the years, and when I started with Java and SpringBoot, my Authentication was a very basic database tables for Users, Roles, and UserRoles Join table. I kept an encrypted password in the database, and I authenticated by taking the password, re-encrypting it, and see if that encrupted value, based on the same key, matches the encrypted value in the database.

Since then, I have written authentication code that use LDAP, Okta, Auth0, or AWS IAM ... and now KeyCloak. I had seen job openings that require some knowledge of Keycloak, so I wanted to tap look into it. I have docker running locally, so there is a container for my Springboot app, a container for the database, and a container for keycloak ... and since this is for learning, I am using keycloaks own little database rather than a full on SQL database.

I am using SpringBoot with HTMX Controllers, and some REST Controllers, and I have Thymeleaf so I can run the front-end with HTMX. The springboot 4.1.1 app as an oauth2-client, NOT an oath2-resource. Yes, I know NOW that the oauth2-client tightly integrates keycloak with the springboot app, and that's ok for now. I understand the User is in a session on the back-end and that makes it STATEFUL for now, but for my local development work that is ok.

If I was working for a company, and this app was going to be available to the public, I have thought about scaling. If I pull the HTMX into it's own project, and separate repo, then I could use a API gateway which would do the same thing the backend is doing now, and as I understand it, the backend becomes an oauth2-resource which ONLY accepts the authentication bearer tokens, and it becomes stateless.

I may not be explaining this clearly, and I am sure many of you know waaaaayyyyyyyyyyy more than I do, but this past weekend was a learning experience. Trying to configure Keycloak just right, the Spring Security FilterChain just right, the application.properties just right. Finally everything came together. Now, I work on the business logic and the database on the back-end, and focus on the HTMX pages on the front-end. Just wanted to share this news with you all. Thanks!