To be able to secure WAR apps deployed on JBoss AS 7.1.1, JBoss EAP 6.x, or Wildfly, you must install and configure the Keycloak Subsystem. You then have two options to secure your WARs. You can provide a keycloak config file in your WAR and change the auth-method to KEYCLOAK within web.xml. Alternatively, you don't have to crack open your WARs at all and can apply Keycloak via the Keycloak Subsystem configuration in standalone.xml. Both methods are described in this section.

This is a adapter zip file for AS7, EAP, and Wildfly in the adapters/ directory in the Keycloak distribution. Install on Wildfly: $ cd $WILDFLY_HOME $ unzip keycloak-wildfly-adapter-dist.zip Install on JBoss EAP 6.x: $ cd $JBOSS_HOME $ unzip keycloak-eap6-adapter-dist.zip Install on JBoss AS 7.1.1: $ cd $JBOSS_HOME $ unzip keycloak-as7-adapter-dist.zip This zip file creates new JBoss Modules specific to the Wildfly Keycloak Adapter within your Wildfly distro. After adding the Keycloak modules, you must then enable the Keycloak Subsystem within your app server's server configuration: domain.xml or standalone.xml. For Wildfly: ... ... ]]> For JBoss AS 7.1.1 and EAP 6.x: ... ... ]]> Finally, for both AS7, EAP 6.x, and Wildfly installations you must specify a shared keycloak security domain. This security domain should be used with EJBs and other components when you need the security context created in the secured web tier to be propagated to the EJBs (other EE component) you are invoking. Otherwise this configuration is optional. ... ]]> For example, if you have a JAX-RS service that is an EJB within your WEB-INF/classes directory, you'll want to annotate it with the @SecurityDomain annotation as follows: getCustomers() { return db.getCustomers(); } } ]]> We hope to improve our integration in the future so that you don't have to specify the @SecurityDomain annotation when you want to propagate a keycloak security context to the EJB tier.

This section describes how to secure a WAR directly by adding config and editing files within your WAR package. The first thing you must do is create a keycloak.json adapter config file within the WEB-INF directory of your WAR. The format of this config file is describe in the general adapter configuration section. Next you must set the auth-method to KEYCLOAK in web.xml. You also have to use standard servlet security to specify role-base constraints on your URLs. Here's an example pulled from one of the examples that comes distributed with Keycloak. customer-portal Admins /admin/* admin Customers /customers/* user /* CONFIDENTIAL KEYCLOAK this is ignored currently/realm-name> admin user ]]>

You do not have to crack open a WAR to secure it with Keycloak. Alternatively, you can externally secure it via the Keycloak Subsystem. While you don't have to specify KEYCLOAK as an auth-method, you still have to define the security-constraints in web.xml. You do not, however, have to create a WEB-INF/keycloak.json file. This metadata is instead defined within XML in your server's domain.xml or standalone.xml subsystem configuration section. demo MIGfMA0GCSqGSIb3DQEBAQUAA http://localhost:8081/auth true customer-portal password ]]> The security-deployment name attribute identifies the WAR you want to secure. Its value is the module-name defined in web.xml with .war appended. The rest of the configuration corresponds pretty much one to one with the keycloak.json configuration options defined in general adapter configuration. The exception is the credential element. To make it easier for you, you can go to the Keycloak Adminstration Console and go to the Application/Installation tab of the application this WAR is aligned with. It provides an example XML file you can cut and paste. There is an additional convenience format for this XML if you have multiple WARs you are deployment that are secured by the same domain. This format allows you to define common configuration items in one place under the realm element. MIGfMA0GCSqGSIb3DQEBA http://localhost:8080/auth true demo customer-portal password demo product-portal password demo database-service true ]]>