Keycloak Explained: Core IAM Concepts Developers Need for App Security

·2 views

Keycloak is an open-source Identity and Access Management solution maintained by Red Hat that centralises authentication and authorisation for modern web applications. It supports industry standards including OAuth 2.0, OpenID Connect, and SAML 2.0, making it suitable for microservices, single-page applications, and mobile apps. The platform organises security through Realms, which are isolated management spaces for users, roles, and clients, with separate realms recommended for each application environment. Clients in Keycloak are categorised as public, confidential, or bearer-only depending on their ability to securely store credentials. A typical login flow involves redirecting users to Keycloak for authentication, issuing a short-lived authorisation code, and exchanging it for JWT-based access, ID, and refresh tokens used to secure API requests.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build Reliable Notification Deduplication in Go Gaming Voice Lobbies

Notification deduplication in gaming voice lobbies requires treating event identity as a server-owned contract, not a transport guarantee. Each business event must be assigned a stable, unique ID before fan-out, and that ID must be reused on retries rather than regenerated. Clients should maintain a record of applied event IDs and share their last checkpoint upon reconnecting, allowing the server to reconcile state against durable events instead of inferring it from socket status. Fan-out operations must be designed to be idempotent, so repeated delivery attempts do not produce duplicate effects. The system's reliability rests on four clear invariants covering authorization, event identity, idempotent application, and separate audit trails for authentication, subscription, and delivery.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

5 Core JavaScript Concepts Intermediate Developers Should Deeply Understand

A technical guide published on DEV Community outlines five foundational JavaScript concepts that often trip up intermediate developers despite their practical experience. The topics covered include execution contexts and hoisting, where variables declared with var are initialized to undefined while let and const enter a Temporal Dead Zone before their declaration. The guide also breaks down the four primary rules governing the this keyword, noting that arrow functions lexically inherit this rather than defining their own. Closures are explained as a mechanism for retaining access to outer function variables even after execution ends, historically used to simulate private state. The article aims to help developers move beyond framework familiarity and build a stronger grasp of how JavaScript behaves under the hood.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Security Knowledge Is Now a Core Skill for Every Software Developer

The traditional model of handing off code to security teams just before release is increasingly seen as outdated and costly in modern software development. The 'Shift Left' philosophy advocates embedding security practices early in the development cycle, with IBM research suggesting fixes in production can cost up to 30 times more than those caught during design. Developers who understand attack vectors such as SQL injection, cross-site scripting, and insecure direct object references are better equipped to write secure code from the outset. Automated scanning tools, while useful, cannot detect context-specific business logic flaws that only a developer familiar with the application domain can identify and prevent. As software increasingly relies on open-source packages, security-aware developers are also better positioned to manage supply chain risks introduced through dependency ecosystems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Codex, Cursor, or Claude Code: A Practical Guide to AI Coding Assistants

The AI-assisted development space is now dominated by three distinct tools: OpenAI's Codex, Cursor, and Anthropic's Claude Code, each built around a different workflow paradigm. Codex, originally a GPT-3 derivative trained on public GitHub code, pioneered inline autocomplete and remains the foundation of tools like GitHub Copilot, though its standalone API has since been deprecated. Cursor is a full VS Code fork engineered for deep codebase integration, offering repository-wide indexing, multi-file editing via its Composer feature, and support for multiple AI models including GPT-4o and Claude 3.5 Sonnet. Claude Code, powered by Anthropic's Claude 3.5 Sonnet, takes an agentic CLI-based approach, bringing AI assistance directly into the terminal. Choosing between them depends on a developer's workflow needs — inline speed, visual multi-file editing, or terminal-based agentic control.

0 comments Read more at DEV Community