Red Hat SSO, or its open source counterpart Keycloak, is one of the leading products for web single sign-on. It builds on established standards such as Security Assertion Markup Language (SAML) 2.0, OpenID Connect, and OAuth 2.0. One of its useful strengths is that Keycloak can be reached in several ways: through a standard HTML login form or directly through API calls. The walkthrough below uses API calls to generate and verify a JWT, which means the Keycloak UI does not have to be exposed to the public.
Create a user
Start by creating a simple user in Keycloak.
Fill in the required fields, including Username, First Name, and Last Name.
Then assign the user a password.
Create a client
Next, create a client in your realm. In Keycloak, a client represents the resources a particular user can access. It is used to authenticate the user, request identity information, or validate access tokens.
Click Create to open the Add Client dialog.
Complete all required fields in the client form. Pay particular attention to Direct Grant Flow and set its value to direct grant. Also change Access Type to confidential.
Finally, under Client Authenticator, change the client credentials to Client Id and Secret.
Test the new client
You can now test the client through the REST API to simulate a simple login. The authentication URL is:
http://localhost:8080/auth/realms/<your-realm-name>/protocol/openid-connect/token
Fill in the parameters, using your username and password along with the client_id and client_secret. Alternatively, use a REST API tool such as Postman to simulate an HTTP POST request.
With valid credentials, the result is a valid JWT token. A wrong username and password combination returns HTTP 401 and an error response body.
At this point, you have configured a login API that works with Keycloak.