IM is a microservice for Identity and Access Management built with Kotlin and Spring Cloud Function, leveraging a Keycloak instance. It enables the creation and management of Spaces, Users, Organizations, and Privileges, which can then be used to authenticate via Keycloak.

1. Overview
2. Architecture
3. Configuration
   • Application Configuration
   • Docker-Compose Configuration
4. Features and Functionalities
   • Users
   • Organizations
   • Privileges
     • Features
     • Roles
     • Permissions
5. Getting Started
6. Testing
7. Troubleshooting
8. Keycloak Integration
   • Keycloak Plugin
   • IM-Event-HTTP

IM simplifies identity and access management with the following features:

• User Management: Handle individual identities, roles, and permissions.
• Organization Management: Group users and assign collective roles and privileges.
• Privileges: Manage granular permissions, roles, and access control.

IM interacts with Keycloak using Keycloak's Admin Client and exposes endpoints to communicate with other applications.

Define the necessary parameters in your application.yml file:

connect:
    fs:
        url: http://fs:8090

A sample docker-compose configuration for the IM Gateway:

services:
    im-gateway:
    image: ${DOCKER_REPOSITORY}im-gateway:${VERSION_IM}
    environment:
        - server_port=8004
        - f2_tenant_issuer-base-uri=${KC_URL_PUBLIC}
        - connect_im_keycloak_url=${KC_URL_PUBLIC}
        - connect_im_keycloak_realm=${KC_ROOT_REALM}
        - connect_im_keycloak_clientId=${KC_IM_CLIENT_ID}
        - connect_im_keycloak_clientSecret=${KC_IM_CLIENT_SECRET}
    ports:
      - "8004:8004"

• Represent individual identities with specific roles and permissions.
• Can belong to one or more organizations.
• Authenticate through Keycloak, operating within assigned permissions.

• Represent collective entities grouping multiple users.
• Have roles that define overarching permissions and features.
• Govern actions available to users within the organization.

Features act as access control filters, defining the specific contexts in which permissions can be applied. They ensure permissions are valid only in allowed contexts.

• Roles group permissions for users or organizations.
• They simplify access management and can define bindings to other roles or users.

Use the following dependencies in your Kotlin project to manage Users, Organizations, and Roles:

implementation("io.komune.im:user-domain:${Versions.im}")
implementation("io.komune.im:organization-domain:${Versions.im}")
implementation("io.komune.im:role-domain:${Versions.im}")

The clients provided use Ktor and should be singletons:

@Configuration
class ImConfig(
private val tokenProvider: TokenProvider
) {
@Value("\${im.url}")
lateinit var imUrl: String

    @Bean
    fun userClient() = UserClient(
        url = imUrl,
        generateBearerToken = tokenProvider::getToken
    )
}

1. Create a module inside i2-keycloak:keycloak-plugin
2. Build it with ./gradlew i2-keycloak:keycloak-plugin:shadowJar
3. Build the Dockerfile located in i2-keycloak/docker/
4. Enjoy

(steps 2 and 3 can be done automatically with make package-keycloak)

client ("xxx-web" + "account") hardcoded claim: event-http-wehbook = url to send the events to

if local and keycloak is within docker container, use ip address instead of localhost

It is possible to filter the events to send from the keycloak GUI by going to Events > Login Events Settings > Save Events ON > Saved Types

Endpoint example:

@Configuration
class KeycloakEventEndpoint(
    private val applicationContext: ApplicationContext
) {

    @PermitAll
    @Bean
    fun keycloakEvent(): F2Consumer<KeycloakHttpEvent> = f2Consumer { event ->
        println(event.type)
        applicationContext.publishEvent(event)
    }
}