How to Use Keycloak with Symfony

Keycloak is an open-source identity and access management solution that provides robust security features for web applications. If you are a security expert looking to integrate Keycloak with Symfony, the following steps will guide you through the process:

Install the Keycloak Bundle

To start using Keycloak with Symfony, you need to install the Keycloak Bundle. This bundle provides the necessary integration between Symfony and Keycloak. You can install it using Composer by running the following command:

composer require trikoder/oauth2-bundle

Configure the Keycloak Bundle

Once the bundle is installed, you need to configure it to connect to your Keycloak server. Open the config/packages/oauth2.yaml file and add the following configuration:

oauth2:
    resource_owners:
        keycloak:
            type:                keycloak
            client_id:           YOUR_CLIENT_ID
            client_secret:       YOUR_CLIENT_SECRET
            base_url:            https://your-keycloak-server/auth/realms/your-realm
            redirect_route:      keycloak_auth_redirect
            redirect_params:     {}
            check_path:          /keycloak_auth_check
            failure_path:        /keycloak_auth_failure

Make sure to replace YOUR_CLIENT_ID, YOUR_CLIENT_SECRET, https://your-keycloak-server/auth/realms/your-realm with the appropriate values for your Keycloak setup.

Configure Symfony Security

Next, you need to configure Symfony's security system to use Keycloak for authentication. Open the config/packages/security.yaml file and add the following configuration:

security:
    providers:
        keycloak:
            id: trikoder.oauth2.user_provider

    firewalls:
        main:
            anonymous: lazy
            oauth:
                resource_owners:
                    keycloak: "/login/check-keycloak"
                login_path: /login
                use_forward: false
                failure_path: /login

    access_control:
        - { path: ^/admin, roles: ROLE_ADMIN }
        - { path: ^/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/secured, roles: ROLE_USER }

Implement Keycloak Authentication

Now it's time to implement Keycloak authentication in your Symfony application. Create a new controller, for example src/Controller/KeycloakController.php, and add the following code:

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\Routing\Annotation\Route;

class KeycloakController extends AbstractController
{
    /**
     * @Route("/login/check-keycloak", name="keycloak_auth_redirect")
     */
    public function redirectAction()
    {
        // This action is handled by the Keycloak Bundle
    }

    /**
     * @Route("/login/keycloak", name="keycloak_auth_check")
     */
    public function checkAction()
    {
        // This action is handled by the Keycloak Bundle
    }

    /**
     * @Route("/login/keycloak-failure", name="keycloak_auth_failure")
     */
    public function failureAction()
    {
        // This action is handled by the Keycloak Bundle
    }
}

These actions will handle the Keycloak authentication process and redirect the user accordingly.

Protect Routes with Keycloak

Finally, you can protect specific routes in your Symfony application using Keycloak authentication. For example, if you want to protect the /secured route, open the corresponding controller and add the @Security("is_granted('ROLE_USER')") annotation:

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\Routing\Annotation\Route;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;

class MyController extends AbstractController
{
    /**
     * @Route("/secured", name="secured_route")
     * @Security("is_granted('ROLE_USER')")
     */
    public function securedAction()
    {
        // This route is protected by Keycloak authentication
    }
}

With these steps, you have successfully integrated Keycloak with Symfony and added authentication to your application using Keycloak's security features.

Remember to adjust the configuration and code snippets according to your specific requirements and Keycloak setup.

---