Keycloak self-service clients

This projects allows Keycloak users to create and manage their own clients. Intentionally, users are not allowed to set all parameters but this project does take opinionated assumptions.

The goal is to provide users a way to easily attach their applications to Keycloak without going through a complicated process with e.g. the IT department.

Components

The project consists of two main components:

• Keycloak Plugin
• Web GUI

Features supported (API and GUI)

Methods:

• Client creation
• Client deletion
• Client listing

Client options:

• Public / Secret clients
• Set arbitrary client IDs, but all prefixed with ssc-
• Specifying URLs for login and logout (front- and backchannel)

All data is stored within Keycloak normal data structure, therefore the plugin and web gui is stateless. Whether users are allowed to modify clients is specified via a client attribute (self-service-clients-user-<user-UUID>: "manager").

Development setup

The project ships with a devcontainer configuration. It is recommended to use it as it includes all development dependencies. The git repo must be cloned with git-lfs support.

After the devcontainer finished setting up the container, run docker compose up within the testing directory. If you are not using the devcontainer, you must first build the Keycloak plugin according to its Readme.

Now, create a realm test within Keycloak and the client self-service-clients with the client role manage-self-service-clients. Add a user with this client role. This user is now able to manage their own self service clients.

Production setup

This section describes how to set up both components for a production setup.

Keycloak

• Download the latest artifacts (main) from the Pipeline.
• Place the self-service-clients-XXX.jar to your providers directory (/opt/keycloak/providers for Docker).
• Restart Keycloak.
• Create client self-service-clients with manage-self-service-clients client role for each realm you want the API to work with.
  • Public Client
  • No direct grant
  • Add as Origin the intended Web GUI origin
• Assign manage-self-service-clients to users as you want.

Then, the API is ready to use.

Compatiblity

The plugin versions are compatible with these keycloak versions:

SSC Plugin Version	Keycloak Min. Version	Keycloak Max Version
0.1.0	24.0.0	24.0.5
0.2.0	26.3.0	26.4.1

Web frontend

• Get the latest Docker container (dr.rechenknecht.net/mixxplorer/keycloak/self-service-clients/main/frontend:latest or take a look at GitLab registry). Versioned container are available as well, please check the registry.
• Run by e.g. docker run -it --rm -p 127.0.0.1:1235:8080 -e KEYCLOAK_URL=http://127.0.0.1:8080 -e KEYCLOAK_REALM=test dr.rechenknecht.net/mixxplorer/keycloak/self-service-clients/main/frontend:latest
• Access the frontend, everything should work.

Acknowledgments

🔥 Initial development of this project is funded by the Hasso-Plattner-Institute.