wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
LDAP only verifies users, but it is not sufficient for modern security requirements. Keycloak is a complete open-source SSO solution that can integrate with LDAP and provides secure APIs through JWT tokens.

**Entity Management Tool – LDAP vs Keycloak**

===== 1. LDAP =====

==== Best for ====

Internal company logins

Simple username/password authentication

==== What LDAP does (Simple terms) ====

LDAP (Lightweight Directory Access Protocol) is a **central user directory**

It only verifies **username and password**

It tells the application **YES / NO** (valid user or not)

==== How LDAP login works ====

User enters username & password

Application sends credentials to LDAP

LDAP verifies user

LDAP returns YES / NO

Application creates its own session

==== Limitations of LDAP ====

No social login

No JWT / access tokens

No Single Sign-On (SSO)

Hard to manage roles & permissions dynamically

Old technology

Weak for modern APIs and mobile applications

Not provide any public api for authentication or user management

===== 2. Keycloak =====

==== What is Keycloak? ====

Keycloak is an **open‑source identity and access management server** developed by **Red Hat**.Keycloak is OpenID Connect–based.

==== Main responsibilities ====

User login

Roles & permissions management

JWT token generation

Single Sign-On (SSO)

==== How Keycloak works ====

Application → redirects to Keycloak → user logs in → application receives JWT token

We can customize the Keycloak login page using our own theme. We can also manage users through the Keycloak admin interface or by calling Keycloak APIs from our system.

==== Key benefits ====

Language independent (works with any backend)

Open-source

GUI‑based role & user management

No role & permission stored in application DB

No role & permission hardcoded in code

SSO ready

Highly scalable

Provide public apis.

===== Public APIs =====

===== Authentication =====

Login API

Token generation

Token validation

==== User Management ====

Create user

Assign role

Update user

Disable user

===== 3. Keycloak Login Flow =====

User clicks Login on application

User is redirected to Keycloak login page

User enters credentials

Keycloak verifies user

Keycloak generates JWT token

User is logged into the application

===== 4. Keycloak with LDAP Integration =====

==== Keycloak works with LDAP. ====

==== Flow ====

User data stored in **LDAP**

Login handled by **Keycloak**

Keycloak validates user from LDAP

Keycloak issues **JWT token** to application

==== Advantages ====

No user database in application

No passwords stored in application

Centralized authentication & authorization

But for Keyclock we need to install a keyclock in our server & need to run on another port.

We can install under Same domain

Step : install → run → connect with PHP

**User & Role Hierarchy – Keycloak Integration**

**Keycloak can fully support our existing role and permission structure without any limitation.**

==== Existing Roles in Current System ====

Our application currently has the following user roles, each with different permissions:

Super Admin

Our Agents

Admin

SPOC

Approver

Employee

**How Roles Will Be Managed in Keycloak**

Each existing role will be created in Keycloak as a **Realm Role**:

ROLE_SUPER_ADMIN

ROLE_TAXIVAXI_AGENTS

ROLE_ADMIN

ROLE_SPOC

ROLE_APPROVER

ROLE_EMPLOYEE

Each user will be assigned **one main role** based on their type.

**How Permissions Will Be Managed**

Permissions (what a user can do) will be managed separately using **Client Roles**.

Create booking

View booking

Approve booking

View invoices

Access admin panel

View reports

This allows flexibility without changing application code.

Role & Permission mapping

==== Roles and Permissions ====

**SPOC**

CREATE_BOOKING

\\ 

**EMPLOYEE**

CREATE_BOOKING

===== JWT Token After Login =====

After successful login, the system receives a **JWT token** from Keycloak containing the user’s roles and permissions.

Example: SPOC Token

{

  "roles": ["ROLE_SPOC"],

  "permissions": ["CREATE_BOOKING",”VIEW_BOOKING”]

} 

Example: Employee Token

{

  "roles": ["ROLE_EMPLOYEE"],

  "permissions": ["CREATE_BOOKING"]

}

Then our system will check if there is an option create booking then show create booking option.

if (userHasPermission('CREATE_BOOKING')) {

    showCreateBookingButton();

}

**If One user has multiple roles:**

So **permissions should depend on the selected role at login time**, not on all roles together.

How it works

User logs in

The system asks: “Login as which role?”

Approver

Employee

SPOC

User selects one role

Keycloak issues JWT token **only with permissions of the selected role**

Application uses that token

**Authentication & Authorization for Microservices**

**Keycloak fits very well for microservices.Keycloak acts as a central authentication & authorization server.**

User logs in via Keycloak

Keycloak verifies credentials

Keycloak issues JWT token

Token is sent with every API request

**Each microservice:**

**Reads permissions from JWT**

**Allows or denies access**

**Keycloak with Multiple Microservices**

One login for all services (SSO)

Same token works across services

No duplicate user DBs

**Operational Complexity (Learning & Adoption Effort)**

**For developer**

Basic Keycloak concepts (Realm, Client, Roles)

JWT token structure

Token validation in services

==== For Operations / Admin Team ====

GUI-based user & role management

==== Initial Setup (One-time) ====

Keycloak installation

LDAP / DB integration

Role & permission setup

Token configuration

**End-to-End Authentication & Authorization Flow**

User authentication and token generation are handled by Keycloak, token validation is done at the gateway, and each backend service authorizes requests by checking permissions from the JWT token

**Flow**

User opens the application and initiates login.\\ React application redirects the user to Keycloak for authentication.

**Keycloak (Login + Token)**

User enters credentials.

Keycloak verifies the user (via DB / LDAP).

On success, Keycloak generates a JWT access token.\\ 

**React UI (Receives JWT)**

React receives the JWT token.

\\ 

**React UI → API Call**

For every API request, React sends the JWT token in the request header:

**API Gateway (Token Validation)**

Gateway intercepts the request.

Validates the JWT token:

If the token is invalid → request is rejected.

\\ 

**Node Microservice (Permission Check)**

Backend service reads roles/permissions from the JWT payload.

Checks whether the user has the required permission for the API.

If permission is missing → access denied (403).

\\ 

**Response**

Node microservice sends the response back to the client through the gateway.

React UI displays the result to the user.