Alibaba Cloud Service Mesh:Integrate Keycloak with ASM to implement SSO

Deploy httpbin

Save the following YAML to a file named httpbin.yaml and apply it:

kubectl apply -n default -f httpbin.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: httpbin
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
    service: httpbin
spec:
  ports:
  - name: http
    port: 8000
    targetPort: 80
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
    spec:
      serviceAccountName: httpbin
      containers:
      - image: docker.io/kennethreitz/httpbin
        imagePullPolicy: IfNotPresent
        name: httpbin
        ports:
        - containerPort: 80

Deploy Keycloak

Save the following YAML to a file named keycloak.yaml and apply it:

kubectl apply -n default -f keycloak.yaml

apiVersion: v1
kind: Service
metadata:
  name: keycloak
  labels:
    app: keycloak
spec:
  ports:
  - name: http
    port: 8080
    targetPort: 8080
  selector:
    app: keycloak
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  labels:
    app: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
      - name: keycloak
        image: quay.io/keycloak/keycloak:latest
        args: ["start-dev"]
        env:
        - name: KEYCLOAK_ADMIN
          value: "admin"
        - name: KEYCLOAK_ADMIN_PASSWORD
          value: "admin"
        - name: KC_PROXY
          value: "edge"
        ports:
        - name: http
          containerPort: 8080
        readinessProbe:
          httpGet:
            path: /realms/master
            port: 8080

Verify the deployments

Run the following command to confirm both pods are running:

kubectl get pods -n default -l 'app in (httpbin,keycloak)'

Both pods should show Running status with all containers ready (2/2, including the sidecar).

Create a TLS certificate

Create a certificate named myexample-credential for the HTTPS service. For detailed instructions, see Enable secure HTTPS services using an ASM gateway.

Create the gateway rule

In the ASM console, create the following gateway rule. For more information, see Manage gateway rules.

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: ingressgateway
  namespace: istio-system
spec:
  selector:
    app: istio-ingressgateway  # Must match the existing ingress gateway selector
  servers:
    - hosts:
        - '*'
      port:
        name: http-httpbin      # HTTPS on port 443 for the demo application
        number: 443
        protocol: HTTPS
      tls:
        credentialName: myexample-credential
        mode: SIMPLE
    - hosts:
        - '*'
      port:
        name: keycloak          # HTTP on port 80 for the Keycloak console
        number: 80
        protocol: HTTP

Create the virtual service

Create a virtual service to route traffic to httpbin and Keycloak. For more information, see Manage virtual services.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: ingressgateway-vs
  namespace: istio-system
spec:
  gateways:
    - ingressgateway
  hosts:
    - '*'
  http:
    - match:
        - port: 80
      name: keycloak
      route:
        - destination:
            host: keycloak.default.svc.cluster.local
            port:
              number: 8080
    - name: httpbin
      route:
        - destination:
            host: httpbin.default.svc.cluster.local
            port:
              number: 8000

Verify Keycloak access

Open http://<ingress-gateway-address> in a browser. The Keycloak welcome page should appear.

Click Administration Console and log in with the admin credentials specified in the Keycloak deployment (admin / admin).

Create a realm

1. In the Keycloak admin console, click the Master dropdown in the upper-left corner.

2. Click Create Realm.

3. Set the realm name to Test-oidc and click Create.

Create a client

1. In the left navigation pane, click Clients > Create client.

2. Set the following fields:

   Field	Value
   Client Type	OpenID Connect
   Client ID	oauth2proxy

3. Click Next, then enable Client authentication.

4. Click Save.

Create a test user

1. In the left navigation pane, click Users > Add user.

2. Enter a username and click Save.

1. On the User details page, click the Credentials tab.

2. Click Set password, enter a password, turn off Temporary, and click Save.

Create a realm role

1. In the left navigation pane, click Realm roles > Create role.

2. Enter a role name and click Save.

Assign the role to the user

1. Navigate back to the user you created. On the User details page, click the Role mapping tab.

2. Click Assign role, select the role you created, and click Assign.

Create a client scope and mapper

A client scope groups the claims included in the JWT token. The mapper defines how Keycloak populates those claims. For example, you can map the user's realm role to a custom claim in the token so that downstream services can make authorization decisions based on user roles.

1. In the left navigation pane, click Client scopes > Create client scope.

2. Enter a name and click Save.

1. On the client scope page, click the Mappers tab > Configure a new mapper.

2. Select a mapper type (for example, User Realm Role), configure the token claim name, and click Save.

1. Click the Scope tab. Select the role you created earlier and click Assign.

You can preview the resulting JWT token to verify your mapper configuration. In the Keycloak admin console, navigate to Clients > oauth2proxy > Client scopes > Evaluate. Select a user and generate a token preview to confirm the expected claims are present.

Add the client scope to the client

1. Navigate to the oauth2proxy client. Click the Client scopes tab.

2. Click Add client scope, select the scope you created, and add it as a Default scope.

Configure the redirect URI

1. On the oauth2proxy client settings page, locate the Valid redirect URIs field.

2. Add the redirect URI for oauth2-proxy:

https://<your-ASM-gateway-address>/oauth2/callback

1. Click Save.

Only the Keycloak service uses HTTP in this guide. All other services use HTTPS. The redirect URI must use https://.

Record the Keycloak configuration

Save the following values for the next step:

Associate the OIDC authorization service

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. Click the name of your ASM instance. In the left-side navigation pane, choose Mesh Security Center > Custom Authorization Service.

3. Click Associate Custom Authorization Service, select OIDC Identity Authentication And Authorization Service, and configure the following parameters:

1. Click Create.

Create the oauth2-proxy virtual service

Create a virtual service that routes /oauth2 requests to the oauth2-proxy service deployed by ASM:

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: oauth2-vs
  namespace: istio-system
spec:
  gateways:
    - ingressgateway
  hosts:
    - '*'
  http:
    - match:
        - uri:
            prefix: /oauth2
      name: oauth2
      route:
        - destination:
            host: asm-oauth2proxy-httpextauth-oidc.istio-system.svc.cluster.local
            port:
              number: 4180

Replace the host value with the actual oauth2-proxy service name in the istio-system namespace of your ACK cluster.

No other virtual service should match paths with the /oauth2 prefix. Conflicting route rules cause authentication callbacks to fail.

Test SSO login

1. Open https://<ASM-gateway-external-IP> in a browser. The oauth2-proxy sign-in page appears, confirming that SSO enforcement is active.

   

2. Click Sign in with OpenID Connect. The browser redirects to the Keycloak login page.

3. Enter the test username and password you created in Step 3 and click Log On. After successful authentication, the browser redirects to the httpbin application.

   

Inspect the JWT token

To confirm that ASM correctly validates the OIDC token and forwards the authenticated identity to the application:

1. In the httpbin UI, click Request inspection > /headers > try it out > Execute. The response headers include an Authorization header with a Bearer token.

   

2. Copy the token value (everything after Bearer ) and paste it into a JWT debugger such as jwt.io. The decoded payload contains the user information from Keycloak, including the username, realm roles, and any custom claims configured through the mapper.