donghyeon.kang/keycloak-pattern
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat: add shared realm and pattern clients

Browse Source
This commit is contained in:
donghyeon-ka
2026-07-25 13:21:36 +09:00
parent 5ddb97d3a1
commit 998eada6f5
7 changed files with 397 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
keycloak/import/keycloak-patterns-realm.json
+165
View File
@@ -0,0 +1,165 @@
{
"realm": "keycloak-patterns",
"displayName": "Keycloak Authentication Patterns",
"enabled": true,
"sslRequired": "external",
"registrationAllowed": false,
"resetPasswordAllowed": false,
"editUsernameAllowed": false,
"loginWithEmailAllowed": true,
"duplicateEmailsAllowed": false,
"bruteForceProtected": true,
"accessTokenLifespan": 300,
"ssoSessionIdleTimeout": 1800,
"ssoSessionMaxLifespan": 36000,
"offlineSessionIdleTimeout": 2592000,
"revokeRefreshToken": true,
"refreshTokenMaxReuse": 0,
"roles": {
"realm": [
{
"name": "admin-role",
"description": "Administrative role used by authorization examples"
},
{
"name": "user-role",
"description": "Regular authenticated user role"
}
]
},
"clients": [
{
"clientId": "spa-public",
"name": "AP1 SPA Public Client",
"description": "Browser-based OAuth client using Authorization Code and PKCE",
"enabled": true,
"protocol": "openid-connect",
"publicClient": true,
"standardFlowEnabled": true,
"implicitFlowEnabled": false,
"directAccessGrantsEnabled": false,
"serviceAccountsEnabled": false,
"frontchannelLogout": true,
"redirectUris": [
"http://localhost:8088/*",
"http://127.0.0.1:8088/*"
],
"webOrigins": [
"http://localhost:8088",
"http://127.0.0.1:8088"
],
"attributes": {
"pkce.code.challenge.method": "S256",
"post.logout.redirect.uris": "http://localhost:8088/*##http://127.0.0.1:8088/*"
}
},
{
"clientId": "token-mediating-confidential",
"name": "AP2 Token-Mediating Backend",
"description": "Confidential backend that keeps refresh tokens server-side",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"clientAuthenticatorType": "client-secret",
"secret": "${TOKEN_MEDIATING_CLIENT_SECRET}",
"standardFlowEnabled": true,
"implicitFlowEnabled": false,
"directAccessGrantsEnabled": false,
"serviceAccountsEnabled": false,
"frontchannelLogout": true,
"redirectUris": [
"http://localhost:8082/login/oauth2/code/keycloak"
],
"webOrigins": [
"http://localhost:8082"
],
"attributes": {
"post.logout.redirect.uris": "http://localhost:8082/*"
}
},
{
"clientId": "bff-confidential",
"name": "AP3 Backend-for-Frontend",
"description": "Confidential BFF that keeps all OAuth tokens server-side",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"clientAuthenticatorType": "client-secret",
"secret": "${BFF_CLIENT_SECRET}",
"standardFlowEnabled": true,
"implicitFlowEnabled": false,
"directAccessGrantsEnabled": false,
"serviceAccountsEnabled": false,
"frontchannelLogout": true,
"redirectUris": [
"http://localhost:8083/login/oauth2/code/keycloak"
],
"webOrigins": [
"http://localhost:8083"
],
"attributes": {
"post.logout.redirect.uris": "http://localhost:8083/*"
}
},
{
"clientId": "edge-proxy",
"name": "AP4 Edge Forward Auth",
"description": "Confidential oauth2-proxy OIDC client",
"enabled": true,
"protocol": "openid-connect",
"publicClient": false,
"clientAuthenticatorType": "client-secret",
"secret": "${EDGE_PROXY_CLIENT_SECRET}",
"standardFlowEnabled": true,
"implicitFlowEnabled": false,
"directAccessGrantsEnabled": false,
"serviceAccountsEnabled": false,
"frontchannelLogout": true,
"redirectUris": [
"http://localhost:4180/oauth2/callback"
],
"webOrigins": [],
"attributes": {
"post.logout.redirect.uris": "http://localhost:8088/*"
}
}
],
"users": [
{
"username": "admin-user",
"enabled": true,
"email": "admin-user@example.test",
"emailVerified": true,
"firstName": "Admin",
"lastName": "User",
"realmRoles": [
"admin-role"
],
"credentials": [
{
"type": "password",
"value": "${ADMIN_USER_PASSWORD}",
"temporary": false
}
]
},
{
"username": "regular-user",
"enabled": true,
"email": "regular-user@example.test",
"emailVerified": true,
"firstName": "Regular",
"lastName": "User",
"realmRoles": [
"user-role"
],
"credentials": [
{
"type": "password",
"value": "${REGULAR_USER_PASSWORD}",
"temporary": false
}
]
}
]
}