https://gravitate-health.github.io/assets/js/f65295d9.29213da1.js

1"use strict";(self.webpackChunkwebsite=self.webpackChunkwebsite||[]).push([[461],{7234:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>o,contentTitle:()=>c,default:()=>h,frontMatter:()=>l,metadata:()=>r,toc:()=>a});const r=JSON.parse('{"id":"keycloak","title":"Keycloak","description":"Keycloak is the open-source Identity and Access Management (IAM) tool used by FOSPS to handle Authorization and Authentication using OIDC/OAuth protocols.","source":"@site/ref/keycloak.md","sourceDirName":".","slug":"/keycloak","permalink":"/reference/keycloak","draft":false,"unlisted":false,"editUrl":"https://github.com/gravitate-health/gravitate-health.github.io/tree/main/ref/keycloak.md","tags":[{"inline":true,"label":"security","permalink":"/reference/tags/security"},{"inline":true,"label":"authentication","permalink":"/reference/tags/authentication"},{"inline":true,"label":"iam","permalink":"/reference/tags/iam"},{"inline":true,"label":"oauth","permalink":"/reference/tags/oauth"}],"version":"current","sidebarPosition":45,"frontMatter":{"sidebar_position":45,"title":"Keycloak","tags":["security","authentication","iam","oauth"]},"sidebar":"tutorialSidebar","previous":{"title":"Trust Function","permalink":"/reference/trust-function"},"next":{"title":"Metrics Management","permalink":"/reference/metrics"}}');var s=i(4848),t=i(8453);const l={sidebar_position:45,title:"Keycloak",tags:["security","authentication","iam","oauth"]},c="Keycloak",o={},a=[{value:"Purpose",id:"purpose",level:2},{value:"Protocols Supported",id:"protocols-supported",level:2},{value:"OAuth 2.0",id:"oauth-20",level:3},{value:"OpenID Connect (OIDC)",id:"openid-connect-oidc",level:3},{value:"Integration in FOSPS",id:"integration-in-fosps",level:2},{value:"Protected Resources",id:"protected-resources",level:3},{value:"User Types",id:"user-types",level:3},{value:"Token Flow",id:"token-flow",level:3},{value:"Realm Configuration",id:"realm-configuration",level:2},{value:"Security Features",id:"security-features",level:2},{value:"Logging",id:"logging",level:2},{value:"Related Concepts",id:"related-concepts",level:2}];function d(e){const n={a:"a",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,t.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.header,{children:(0,s.jsx)(n.h1,{id:"keycloak",children:"Keycloak"})}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Keycloak"})," is the open-source Identity and Access Management (IAM) tool used by ",(0,s.jsx)(n.a,{href:"/reference/fosps",children:"FOSPS"})," to handle Authorization and Authentication using OIDC/OAuth protocols."]}),"\n",(0,s.jsx)(n.h2,{id:"purpose",children:"Purpose"}),"\n",(0,s.jsx)(n.p,{children:"Keycloak provides:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Authentication"}),": User identity verification"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Authorization"}),": Access control and permissions"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Single Sign-On (SSO)"}),": One login for multiple applications"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Identity Federation"}),": Integration with external identity providers"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Token Management"}),": JWT tokens for API access"]}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"protocols-supported",children:"Protocols Supported"}),"\n",(0,s.jsx)(n.h3,{id:"oauth-20",children:"OAuth 2.0"}),"\n",(0,s.jsx)(n.p,{children:"Authorization framework for:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"API access control"}),"\n",(0,s.jsx)(n.li,{children:"Delegated authorization"}),"\n",(0,s.jsx)(n.li,{children:"Client credentials flow"}),"\n",(0,s.jsx)(n.li,{children:"Authorization code flow"}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"openid-connect-oidc",children:"OpenID Connect (OIDC)"}),"\n",(0,s.jsx)(n.p,{children:"Authentication layer on OAuth 2.0:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"User identity tokens"}),"\n",(0,s.jsx)(n.li,{children:"ID token verification"}),"\n",(0,s.jsx)(n.li,{children:"UserInfo endpoint"}),"\n",(0,s.jsx)(n.li,{children:"Session management"}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"integration-in-fosps",children:"Integration in FOSPS"}),"\n",(0,s.jsx)(n.h3,{id:"protected-resources",children:"Protected Resources"}),"\n",(0,s.jsx)(n.p,{children:"Keycloak secures access to:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.a,{href:"/reference/fhir-server",children:"FHIR Server"})," resources"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.a,{href:"/reference/focusing-manager",children:"Focusing Manager"})," APIs"]}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.a,{href:"/reference/supporting-material",children:"Supporting Material"})}),"\n",(0,s.jsx)(n.li,{children:"Administrative interfaces"}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"user-types",children:"User Types"}),"\n",(0,s.jsx)(n.p,{children:"Different authentication for:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Patients"}),": Accessing ",(0,s.jsx)(n.a,{href:"/reference/f-epi",children:"f(ePI)"})," and ",(0,s.jsx)(n.a,{href:"/reference/ips",children:"IPS"})]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Healthcare Professionals"}),": Clinical tools"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Administrators"}),": Platform management"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.strong,{children:"Developers"}),": API access, ",(0,s.jsx)(n.a,{href:"/reference/focusing-inspector",children:"Focusing Inspector"})]}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"token-flow",children:"Token Flow"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsx)(n.li,{children:"User authenticates with Keycloak"}),"\n",(0,s.jsx)(n.li,{children:"Receives JWT access token"}),"\n",(0,s.jsx)(n.li,{children:"Includes token in API requests"}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.a,{href:"/reference/istio",children:"Istio"})," validates token"]}),"\n",(0,s.jsx)(n.li,{children:"Request forwarded to service"}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"realm-configuration",children:"Realm Configuration"}),"\n",(0,s.jsx)(n.p,{children:"FOSPS uses Keycloak realms for:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Multi-tenancy (different FOSPS instances)"}),"\n",(0,s.jsx)(n.li,{children:"Role-based access control (RBAC)"}),"\n",(0,s.jsx)(n.li,{children:"Client application registration"}),"\n",(0,s.jsx)(n.li,{children:"Identity provider mapping"}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"security-features",children:"Security Features"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.strong,{children:"Multi-Factor Authentication (MFA)"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.strong,{children:"Brute force detection"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.strong,{children:"Session management"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.strong,{children:"Password policies"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.strong,{children:"Account lockout"})}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"logging",children:"Logging"}),"\n",(0,s.jsxs)(n.p,{children:["Authentication events logged to ",(0,s.jsx)(n.a,{href:"/reference/audit-log",children:"Audit Log"}),":"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Login attempts (success/failure)"}),"\n",(0,s.jsx)(n.li,{children:"Token issuance"}),"\n",(0,s.jsx)(n.li,{children:"Permission grants"}),"\n",(0,s.jsx)(n.li,{children:"Session expiration"}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"related-concepts",children:"Related Concepts"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.a,{href:"/reference/fosps",children:"FOSPS"})," - Platform architecture"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.a,{href:"/reference/istio",children:"Istio"})," - JWT validation"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.a,{href:"/reference/audit-log",children:"Audit Log"})," - Security logging"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.a,{href:"/reference/fhir-server",children:"FHIR Server"})," - Protected resources"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.a,{href:"/reference/focusing-manager",children:"Focusing Manager"})," - Protected APIs"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},8453:(e,n,i)=>{i.d(n,{R:()=>l,x:()=>c});var r=i(6540);const s={},t=r.createContext(s);function l(e){const n=r.useContext(t);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:l(e.components),r.createElement(t.Provider,{value:n},e.children)}}}]);