🔐
Keycloak 26.2
Enterprise IdP with OAuth 2.0, OIDC, and SAML support. Shared across all labs.
Auth Protocol LabOAuth 2.0 & OIDC with Keycloak
Hands-on labs for every major authentication flow -- built with Go, React, and Terraform
Skip to content
Labs
Each lab is a self-contained implementation of a specific authentication flow. Shared infrastructure (Keycloak, Postgres, MinIO, Terraform) runs once; labs connect to the auth-lab Docker network.
Implemented
| Lab | Flow | Directory | Status |
|---|---|---|---|
| 01 | Authorization Code | labs/01-authorization-code/ | Complete |
Planned
| Lab | Flow | Description |
|---|---|---|
| 02 | Auth Code + PKCE | Proof Key for Code Exchange for public clients |
| 03 | Client Credentials | Machine-to-machine with no user context |
| 04 | Implicit (Deprecated) | Educational -- why this flow was replaced by PKCE |
| 05 | ROPC | Resource Owner Password Credentials -- legacy migration |
| 06 | Device Authorization | Limited-input devices (TVs, IoT, CLIs) |
| 07 | Refresh Tokens | Token rotation, revocation, sliding sessions |
| 08 | Dex Federation | Identity brokering with upstream connectors |
| 09 | SAML 2.0 | Enterprise SSO with SAML assertions |
| 10 | Social Login | Google, GitHub, Microsoft via Keycloak |
| 11 | BFF Pattern | Backend-for-Frontend secure token handling |
| 12 | API Gateway | Centralized auth with Kong or Traefik |
Separate Projects
Azure Entra ID and AWS Cognito labs live in their own repositories. See the Roadmap for details.
Quick Start
Step 1: Start Shared Infrastructure
bash
cd authentication/infrastructure
docker compose up -dThis starts Keycloak, PostgreSQL, MinIO, and the Terraform container. Wait for Keycloak to become healthy (~60s).
Step 2: Apply Shared Terraform
bash
docker exec -it terraform-auth zsh
cd /home/developer/workspace/keycloak
terraform init && terraform apply -auto-approveThis creates the auth-server realm, the owner user, and shared roles.
Step 3: Start a Lab
bash
cd authentication/labs/01-authorization-code
docker compose up -dEach lab has its own docker-compose.yaml that joins the auth-lab network.
Step 4: Apply Lab Terraform (if applicable)
bash
# Still inside the terraform container
cd /home/developer/workspace/labs/01-authorization-code/terraform
terraform init && terraform apply -auto-approveThis registers the lab-specific OIDC client and scopes.
Step 5: Open the App
Navigate to http://localhost:5173 and log in with owner / owner.
TIP
Run docker compose ps in both the infrastructure/ and lab directories to verify all containers are healthy before testing.
Service Map
| Service | Port | Scope | Description |
|---|---|---|---|
| Keycloak | 8080 | Shared | Identity Provider |
| PostgreSQL | 5432 | Shared | Keycloak database |
| MinIO | 9000/9001 | Shared | Terraform state backend |
| Terraform | -- | Shared | IaC container (exec into it) |
| React Client | 5173 | Per-lab | Frontend SPA |
| Go Backend | 8081 | Per-lab | Resource server with JWT validation |