title: How to Setup Keycloak + Spring Boot + Oauth2 within Microservice Architecture
body: <p>I've setup Keycloak and a public/front-end spring boot app successfully. Everything is working as expected. The front-end Spring Boot App is configured in Keycloak as a client (app-ui) in the realm, user's are able to login through keycloak, tokens pass successfully everything's great. Spring Security is securing endpoints and roles are being respected for endpoints.</p>
  
  <p>Now, I'm trying to add a downstream Spring Boot App (Web Service) in the mix and I want it to be aware of the logged in user to be able to secure calls to it. The front-end Spring Boot App is using Feign Client to call the REST endpoints on the back-end Spring Boot App, but the back-end is not doing any authentication/authorization.</p>
  
  <p>I have a couple questions I'm having trouble figuring out:</p>
  
  <ol>
  <li>How do I setup the front-end Spring Boot App to pass the authenticated user details to the back-end Spring Boot App (RequestInterceptor / RestTemplate / Feign config / Http Headers)?</li>
  <li>How do I configure the back-end Spring Boot App to use the authenticated user details it receives from the upstream Spring Boot App and what dependencies do I need to add to the back-end Spring Boot App to facilitate that (org.keycloak:keycloak-spring-boot-starter and org.springframework.boot:spring-boot-starter-security)?</li>
  <li>Is there anything I need to configure in Keycloak for the back-end Spring Boot App? Should it be registered in Keycloak as a confidential/non-public client (e.g. app-api)?</li>
  <li>Is there anything specific to configure in the back-end Spring Boot App? Does it talk to Keycloak to verify the authenticated user details it receives from the upstream callers?</li>
  </ol>
  
  <p>I'd love to see a demo or tutorial that takes the one's I've seen about <code>How to integrate Keycloak and Spring Boot</code> one step farther to also secure any other downstream services. If I can figure this out, I'll post one.</p>
  
  <p>I'm assuming this can be done with standard OAuth2 configuration on the back-end Spring Boot App, but I wasn't sure how it's recommended to achieve this architecture.</p>
  
  <p>Here's the architecture I'm trying to setup:</p>
  
  <p><a href="https://i.stack.imgur.com/2Vl6u.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/2Vl6u.jpg" alt="Spring Boot and Keycloak Architecture"></a></p>