blueprint.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
  ~ and other contributors as indicated by the @author tags.
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~ http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
           xmlns:jaas="http://karaf.apache.org/xmlns/jaas/v1.0.0"
           xmlns:cm="http://aries.apache.org/blueprint/xmlns/blueprint-cm/v1.1.0"
           xmlns:ext="http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.2.0">

    <!-- Bean to allow the $[karaf.base] property to be correctly resolved -->
    <ext:property-placeholder placeholder-prefix="$[" placeholder-suffix="]"/>

    <cm:property-placeholder persistent-id="org.keycloak" update-strategy="reload">
        <cm:default-properties>
            <cm:property name="jaasBearerKeycloakConfigFile" value="$[karaf.base]/etc/keycloak-hawtio.json"/>
            <cm:property name="jaasBearerRolePrincipalClass" value="org.apache.karaf.jaas.boot.principal.RolePrincipal"/>

            <cm:property name="jaasDirectAccessKeycloakConfigFile" value="$[karaf.base]/etc/keycloak-direct-access.json"/>
            <cm:property name="jaasDirectAccessRolePrincipalClass" value="org.apache.karaf.jaas.boot.principal.RolePrincipal"/>
        </cm:default-properties>
    </cm:property-placeholder>

    <jaas:config name="keycloak" rank="1">

        <!-- Used for web authentication (like hawtio) -->
        <jaas:module className="org.keycloak.adapters.jaas.BearerTokenLoginModule"
                     flags="sufficient">
            keycloak-config-file = ${jaasBearerKeycloakConfigFile}
            role-principal-class = ${jaasBearerRolePrincipalClass}
        </jaas:module>

        <!-- Used for direct username/password authentication for non-web scenarios (like ssh) -->
        <jaas:module className="org.keycloak.adapters.jaas.DirectAccessGrantsLoginModule"
                     flags="sufficient">
            keycloak-config-file = ${jaasDirectAccessKeycloakConfigFile}
            role-principal-class = ${jaasDirectAccessRolePrincipalClass}
        </jaas:module>

    </jaas:config>

</blueprint>