Configure Proxy for Keycloak with Spring Boot (Client and Resource Server (OAuth2)) with Nginx inside Docker

Welcome to this comprehensive guide on configuring a proxy for Keycloak with Spring Boot (Client and Resource Server using OAuth2) along with Nginx inside Docker. This article will walk you through the entire process, ensuring you have a seamless and secure setup.

Prerequisites

Before we dive in, make sure you have the following installed on your machine:

• Docker
• Docker Compose
• Java 11 or later
• Maven or Gradle (for building Spring Boot projects)
• A basic understanding of Docker, Spring Boot, and OAuth2

Overview of the Architecture

The architecture we will be implementing consists of the following components:

1. Keycloak (OAuth2 Server)
2. Spring Boot Client (using OAuth2 to authenticate with Keycloak)
3. Spring Boot Resource Server (protected by OAuth2 and authenticated by Keycloak)
4. Nginx (reverse proxy to route requests to the Resource Server)
5. Docker (to containerize all components)

Step 1: Set up Keycloak

First, we’ll create a Docker container for Keycloak:

docker run -d --name keycloak \
  -p 8080:8080 \
  -e KEYCLOAK_USER=admin \
  -e KEYCLOAK_PASSWORD=admin \
  -e KEYCLOAK_REALM=myrealm \
  quay.io/keycloak/keycloak:15.0.2

This command starts a Keycloak container with a realm named “myrealm” and default admin credentials. You can access the Keycloak console at http://localhost:8080.

Step 2: Create Spring Boot Client and Resource Server

Next, we’ll create two separate Spring Boot projects: one for the client and one for the resource server.

Client Project

Create a new Spring Boot project with the following dependencies:

<dependencies>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2</artifactId>
  </dependency>
</dependencies>

In the application configuration file (application.properties or application.yml), add the following:

spring:
  security:
    oauth2:
      client:
        registration:
          keycloak:
            client-id: myclient
            client-secret: mysecret
            authorization-grant-type: authorization_code
            redirect-uri-template: '{baseUrl}/login/oauth2/code/{registrationId}'
        provider:
          keycloak:
            authorization-uri: http://keycloak:8080/auth/realms/myrealm/protocol/openid-connect/auth
            token-uri: http://keycloak:8080/auth/realms/myrealm/protocol/openid-connect/token
            user-info-uri: http://keycloak:8080/auth/realms/myrealm/protocol/openid-connect/userinfo
            user-name-attribute: preferred_username

Resource Server Project

Create another Spring Boot project with the following dependencies:

<dependencies>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
  </dependency>
</dependencies>

In the application configuration file, add the following:

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://keycloak:8080/auth/realms/myrealm

Step 3: Configure Nginx as a Reverse Proxy

Create a new file named nginx.conf with the following content:

http {
  upstream resource_server {
    server resource-server:8081;
  }

  server {
    listen 8080;
    location / {
      proxy_pass http://resource_server;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
    }
  }
}

This configuration sets up Nginx to route requests from http://localhost:8080 to the Resource Server running on http://resource-server:8081.

Step 4: Dockerize the Application

Create a docker-compose.yml file with the following content:

version: '3'
services:
  keycloak:
    image: quay.io/keycloak/keycloak:15.0.2
    environment:
      - KEYCLOAK_USER=admin
      - KEYCLOAK_PASSWORD=admin
      - KEYCLOAK_REALM=myrealm
    ports:
      - "8080:8080"

  client:
    build: ./client
    ports:
      - "8082:8082"
    depends_on:
      - keycloak

  resource-server:
    build: ./resource-server
    ports:
      - "8081:8081"
    depends_on:
      - keycloak

  nginx:
    image: nginx:latest
    ports:
      - "80:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - resource-server

This configuration defines four services: Keycloak, Client, Resource Server, and Nginx. The Client and Resource Server services are built from the respective Spring Boot projects, and Nginx is configured to use the nginx.conf file.

Step 5: Start the Application

Run the following command to start the application:

docker-compose up -d

This command starts all services in detached mode.

Testing the Application

To test the application, access the Client at http://localhost:8082. You should be redirected to the Keycloak login page. After authentication, you’ll be redirected back to the Client, which will then access the protected Resource Server through the Nginx reverse proxy.

Component	URL
Keycloak	http://localhost:8080
Client	http://localhost:8082
Resource Server	http://localhost:8081 (not accessible directly)
Nginx	http://localhost:80 (routes to Resource Server)

Congratulations! You have successfully configured a proxy for Keycloak with Spring Boot (Client and Resource Server using OAuth2) along with Nginx inside Docker.

Troubleshooting Tips

If you encounter any issues, make sure to check the Docker container logs for errors. You can do this by running docker-compose logs -f.

Common issues include:

• Keycloak not starting correctly: Check the Keycloak container logs for errors.
• Client or Resource Server not connecting to Keycloak: Verify the OAuth2 configuration in the application.properties file.
• Nginx not routing requests correctly: Check the nginx.conf file for errors.

I hope this comprehensive guide has helped you set up a secure and scalable architecture using Keycloak, Spring Boot, and Nginx with Docker. Happy coding!

Here are the 5 Questions and Answers about “configure proxy for keycloak with spring boot(client and resource server(oauth2)) with nginx inside docker”:

Frequently Asked Question

Get ready to dive into the world of Keycloak, Spring Boot, and Nginx, all wrapped up in a Docker container! Below, we’ll tackle the most pressing questions on configuring a proxy for Keycloak with Spring Boot (client and resource server OAuth2) and Nginx inside Docker.