Part 3 - Keycloak - API Gateway APIs with Keycloak JWT authentication

In the previous article I showed you how to setup API Gateway in front of your Lambda function.  This article will show you how to setup Keycloak to be used for API Gateway.

Note: once again I am showing you the "ClickOps" method of setting up your environment by doing everything, in this example, though the Keycloak console.  This is not a best practice by any means.  Keycloak has multiple ways to create a script or program to configure it and you should be using tools that allow for repeatability.  But this is meant as a demo and so this version of the document will continue to use this method.

So let's set up a new Keycloak client to handle our API Gateway authorization.  This document will assume that you have a Keycloak instance available on this internet.  It's not too hard to do but look for future articles on the setup for AWS ECS.

To get started, login to your Keycloak instance, change to the correct realm and create a user with a password.  This is a "local" user that isn't tied to a social login like Google.  The user name and password are stored on the Keycloak server.

Next let's create a new client.  Go to "Clients" and then "Create client":

In the next screen, the "Client type" should remain OpenID Connect.  The other choice is SAML which, while Keycloak supports, API Gateway does not.  SAML is similar in concept to Oauth and is a framework for authorization.

Enter a "Client ID" of your choosing.  I'll create "awsapigateway":

Select "Next":

and "Next".  On the third screen there is nothing to enter.  Select "Save" to get to the general configuration screen for the client.

At this point you can use the user you created in the next steps of the process.

Optional - add a client secret to the client.

In some instances it is good to have a Keycloak client have a secret.  This is a shared password that is needed to access the client.  Ultimately it adds an additional layer of security so that only user that know the secret can use the client.

To configure this, go to the client settings tab:

scroll down and turn on "Client authentication":

Save this configuration.  Now, the client configuration includes a "Credentials" tab:

Select the "Credentials" tab and save the "Client Secret" off to your favorite password manager or a file.  We'll use the client secret when we get a token in the last part of this series.

 

Photo by Andy Keyser on Unsplash