keycloak-ui VS spring-authorization-server

Yes, but I expect more issues to come. Especially due to the removal of the old admin-console there might be some strange behavior with existing client / realm configurations where the new admin-console works a bit different then the old one..., e.g.: https://github.com/keycloak/keycloak-ui/issues/4450 and many more...

In Keycloak 19 there is a bug in interface that does not allow opening settings for authenticators. Refer to this issue.

We're actually working on a new version of the Administration UI at the moment (I'm one of the devs) so this is useful feedback. We're looking for folks to try it out, so take a look at https://github.com/keycloak/keycloak-admin-ui/.

You can try it out on the latest Keycloak by passing the --features=admin2 flag on startup.

I had to use keycloak in the past as the authentication service for a work app. Keycloak you can pull the docker image and start it up fairly easy. The UI is built in React with Typescript here https://github.com/keycloak/keycloak-admin-ui.

I use this https://github.com/spring-projects/spring-authorization-server for smaller projects or experimentations. Keeps all the moving parts without going to a 3rd party.

In this section we will use Spring Authorization Server to build an authorization server.In addition, we will also customize the access_token and custom user information endpoints.

You can spin one up in Spring (Java) fairly quickly and boilerplate - Main page and Getting Started Guide.

Is Spring Authorization Server ready for production? Does it only use OAuth 2.1? We currently use `org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure` in our apps with OAuth2 JWT with grant types `password`, and `refresh_token`. If we update our authorization server with Spring Authorization Server, do we have to change all functionalities? Can we use OAuth2 or do we have to start using OAuth2.1?

At the moment of writing this it seems like the documentation is also in the early stages, although I wouldn't expect too much from the documentation later on either if it was to be judged by the docs for the rest of the spring security. You can find the official docs here.

Your example is pretty unconventional though — it seems like you're sort of rolling your own authorization server which will make things difficult. The project has been diligent about removing support for "issuing" JWTs and things like that. If you asked a maintainer about your current approach they'd probably point you to https://spring.io/projects/spring-authorization-server.

It has becone so boilerplate, Spring is actually helping Take a look at: Spring Auth Server

Spring Auth Server

Most of the time, and most examples, will be about using OAuth as a client. But in your case you want to have your own OAuth and Open ID server which will be federated with Facebook and Google. All that means is that you will then have an OAuth server that is also someone else's client, such that your apps authenticate with your server which then uses their servers to actually identify users. This will also come in handy later if you want to set up permissions and what not. Besides Keycloak you might want to look into WSO2 IS or Auth0. Keycloak and WSO2 IS can be run locally, while Auth0 is a cloud service. I'd go with either Keycloak or Auth0. If you go the Spring Authorization Server route, they rolled up an example of federation on the project's Github page. Oauth can be pretty complicated though so I'd suggest that you start off with a ready-made solution. If you stick to Spring Oauth2 Client and avoid things like using Keycloak's specific adapter, it should be easy enough to swap OAuth servers later on. Regarding SAML, I've never used it. I think OAuth is way more prevalent in web development. Here's a comparison, I found it informative. You mentioned tutorials... I bought this course on Udemy last year and it was pretty nice. I browsed some tutorials, and I think this is what you need if you go with Keycloak, assuming you're using Keycloak on the server. If you want to authenticate users on the frontend (running on the browser), you'll want a PKCE flow example.

Spring has an oauth2 authorization server that is currently in early release: https://github.com/spring-projects/spring-authorization-serv...

I'm building something with it currently and it's quite nice, especially if you are already familiar with spring security. Documentation is quite sparse tho.