DT-507: Implement production-ready Keycloak JWT authentication with RBAC by devajipatil · Pull Request #22 · ARENA2036/edc-management-console

devajipatil · 2026-04-30T07:29:44Z

Overview

This PR enhances the existing Keycloak authentication integration to be production-ready by introducing proper JWT validation, role extraction, and role-based access control (RBAC).

Key Changes

1. JWT Validation Improvements

Added JWKS caching with automatic refresh (5 min TTL)
Enforced validation for:
- issuer
- audience
- expiration

2. Role-Based Access Control (RBAC)

Extract roles from:
- realm_access.roles
- resource_access.{client}.roles
Introduced reusable role guards:
- require_user()
- require_creator()
- require_admin()

3. New Auth Module Structure

Added:
auth/

models.py → AuthenticatedUser model
dependencies.py → Role-based guards
keycloak_config.py → Improved JWT handling

4. API Security Changes

Updated endpoints to use role-based dependencies instead of raw token validation
Introduced 403 Forbidden for unauthorized role access

5. Swagger OAuth Improvements

Added PKCE support
Configured scopes (openid, profile, email)

Why This Change

Previous implementation:

Did not validate roles
Used static JWKS (breaks on key rotation)
Allowed any authenticated user full access

This update aligns the backend with production-grade security standards similar to Spring Boot resource server configuration.

Testing

Verified valid token access
Verified expired token → 401
Verified invalid audience → 401
Verified insufficient role → 403

Impact

Breaking change: endpoints now require proper roles
Existing tokens must include correct role mappings in Keycloak

Next Steps

Restrict CORS configuration for production
Add integration tests for role-based endpoints

Copilot

Pull request overview

This PR aims to make backend Keycloak authentication production-ready with JWT validation and RBAC, while also refactoring backend routes/controllers and introducing a large set of frontend dashboard, i18n, dark mode, runtime config, and wizard changes.

Changes:

Reworked backend Keycloak auth to validate JWT issuer/audience/signature and added role guard helpers.
Split backend routes/controllers out of init.py, with updated CORS and API wiring.
Added significant frontend dashboard/UI changes including i18n, dark mode, onboarding, component management, and runtime configuration.

Reviewed changes

Copilot reviewed 46 out of 53 changed files in this pull request and generated 23 comments.

Show a summary per file

File	Description
`package.json`	Adds root React Scripts commands.
`node_modules/.yarn-integrity`	Commits local package manager install artifact.
`frontend/vite.config.ts`	Changes dev server host/port and adds cookie-clearing middleware.
`frontend/tsconfig.node.json`	Removes `erasableSyntaxOnly`.
`frontend/tsconfig.app.json`	Removes `erasableSyntaxOnly`.
`frontend/tailwind.config.js`	Enables class-based dark mode.
`frontend/src/types/index.ts`	Adds dashboard/component types and tightens config typing.
`frontend/src/runtime-config.ts`	Adds runtime/env/fallback config resolution.
`frontend/src/main.tsx`	Wraps app in i18n provider.
`frontend/src/index.css`	Adds global layout and dark-mode styles.
`frontend/src/i18n.tsx`	Adds English/German translation provider.
`frontend/src/config.js`	Updates runtime API/keycloak defaults.
`frontend/src/components/Tooltip.tsx`	Adds shared tooltip component.
`frontend/src/components/StatsCard.tsx`	Adds tooltip and dark-mode support.
`frontend/src/components/Sidebar.tsx`	Reworks navigation with i18n, help, tooltips, and mobile behavior.
`frontend/src/components/OnboardingGuide.tsx`	Adds onboarding guide modal.
`frontend/src/components/Header.tsx`	Adds language/theme/help/menu controls.
`frontend/src/components/DeploymentWizard.tsx`	Replaces connector deployment wizard with simplified flow.
`frontend/src/components/DeleteModal.tsx`	Makes delete modal labels/message configurable.
`frontend/src/components/ConnectorTableNew.tsx`	Adds mobile card rendering.
`frontend/src/components/ConnectorTable.tsx`	Changes delete identifier and responsive table spacing.
`frontend/src/components/ConnectorsManager.tsx`	Adds new connector management UI.
`frontend/src/components/ComponentWizard.tsx`	Adds component/service wizard.
`frontend/src/components/ComponentsManager.tsx`	Adds component/service management UI.
`frontend/src/components/AddComponentDialog.tsx`	Adds add-item selection dialog.
`frontend/src/auth/keycloak.ts`	Reads Keycloak settings from runtime config.
`frontend/src/api/client.ts`	Reads API base URL/key from runtime config.
`frontend/package.json`	Adds dev dependencies and loosens TypeScript range.
`frontend/package-lock.json`	Updates lockfile for frontend dependency changes.
`frontend/.env.example`	Formatting-only newline change.
`frontend/.env`	Replaces placeholders with staging values.
`docs/user-guide/README.md`	Updates SDE URL example.
`backend/utilities/auth_utils.py`	Hardens OAuth token request handling.
`backend/routes/submodel.py`	Adds submodel router.
`backend/routes/health.py`	Adds health router.
`backend/routes/connectors.py`	Adds connector router.
`backend/routes/config.py`	Adds config/dataspace router.
`backend/init.py`	Includes routers and moves CORS setup.
`backend/controllers/submodel_controller.py`	Adds submodel controller logic.
`backend/controllers/health_controller.py`	Adds health controller logic.
`backend/controllers/connectors_controller.py`	Adds connector controller logic.
`backend/controllers/config_controller.py`	Adds config/dataspace controller logic.
`backend/config/configuration.yml`	Updates configured SDE URL.
`backend/auth/models.py`	Adds authenticated user model.
`backend/auth/keycloak_config.py`	Reworks Keycloak JWT validation and Swagger OAuth config.
`backend/auth/dependencies.py`	Adds reusable RBAC guard dependencies.
`.vscode/settings.json`	Adds workspace Python REPL setting.
`.gitignore`	Ignores history and node modules.
`.github/workflows/codeql.yml`	Removes CodeQL `fail-on: error`.

Files not reviewed (1)

frontend/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+from controllers.connectors_controller import *
+
+router = APIRouter(tags=["EDC"])
+
+@router.get("/api/connectors")
+async def list_connectors(request: Request):
+    return await list_connectors(request)
+
+@router.get("/api/connectors/{connector_id}")
+async def get_connector(connector_id: int, user=Depends(keycloak_openid.get_current_user)):
+    return await get_connector(connector_id, user)
+
+@router.post("/api/connector")
+async def add_connector(connector, request: Request):
+    return await add_connector(connector, request)
+
+@router.put("/api/connectors/{connector_id}")
+async def upgrade_connector(connector_id: str, connector, request: Request):
+    return await upgrade_connector(connector_id, connector, request)
+
+@router.delete("/api/connectors/{connector_name}")
+async def delete_connector(connector_name: str, request: Request):
+    return await delete_connector(connector_name, request)


+from controllers.submodel_controller import *
+
+router = APIRouter(tags=["Submodel"])
+
+@router.post("/api/submodel")
+async def add_submodel_service(data: dict, user=Depends(keycloak_openid.get_current_user)):
+    return await add_submodel_service(data, user)
+
+@router.post("/api/submodel/{submodel_service_id}")
+async def add_existing_submodel_service(data: dict, user=Depends(keycloak_openid.get_current_user)):
+    return await add_existing_submodel_service(data, user)


+from controllers.config_controller import *
+
+router = APIRouter()
+
+@router.get("/api/config")
+async def get_config(user=Depends(keycloak_openid.get_current_user)):
+    return get_config(user)
+
+@router.get("/api/dataspace")
+async def get_dataspace_settings(request: Request):
+    return get_dataspace_settings(request)


+{
+  "systemParams": "darwin-arm64-131",
+  "modulesFolders": [
+    "node_modules"
+  ],
+  "flags": [],
+  "linkedModules": [],
+  "topLevelPatterns": [
+    "keycloak-js@^26.2.0",
+    "react-router-dom@^7.9.3"
+  ],
+  "lockfileEntries": {
+    "cookie@^1.0.1": "https://registry.npmjs.org/cookie/-/cookie-1.0.2.tgz",
+    "keycloak-js@^26.2.0": "https://registry.npmjs.org/keycloak-js/-/keycloak-js-26.2.0.tgz",
+    "react-router-dom@^7.9.3": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.9.3.tgz",
+    "react-router@7.9.3": "https://registry.npmjs.org/react-router/-/react-router-7.9.3.tgz",
+    "set-cookie-parser@^2.6.0": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.1.tgz"
+  },
+  "files": [],
+  "artifacts": {}
+}


…ull checks, and circular import

…console into DT-507-backend

DT-507: Add Keycloak JWT auth with RBAC

00c8079

devajipatil requested a review from DominikKuebel-ARENA2036 April 30, 2026 07:42

devajipatil self-assigned this Apr 30, 2026

devajipatil added the enhancement New feature or request label Apr 30, 2026

chore: updated RBAC

fab8922

saudkhan116 requested a review from Copilot May 29, 2026 07:10

Copilot started reviewing on behalf of saudkhan116 May 29, 2026 07:10 View session

Copilot AI reviewed May 29, 2026

View reviewed changes

devajipatil added 6 commits June 2, 2026 14:20

runtime configuration support, �[200~Fix route handlers, deployment n…

84b8a3a

…ull checks, and circular import

Merge branch 'develop' into DT-507-backend

51d7961

chore: dependency update

ee1f493

Merge branch 'DT-507-backend' of github.com:ARENA2036/edc-management-…

6d5ae97

…console into DT-507-backend

chore: bump helm chart version to 3.14.1

fc44bf6

Merge remote-tracking branch 'origin/develop' into DT-507-backend

31e0845

Copilot started work on behalf of saudkhan116 June 9, 2026 13:42 View session

fix: downgrade eslint to unblock dependency check workflow

9622c45

Copilot finished work on behalf of saudkhan116 June 9, 2026 13:49

Copilot AI requested a review from saudkhan116 June 9, 2026 13:49

devajipatil added 3 commits June 9, 2026 15:56

chore: eslint version update and env refinement

31c843a

chore: eslint version update and env refinement

3da75aa

chore: eslint version update

c420f6f

Navigation Menu

Uh oh!

DT-507: Implement production-ready Keycloak JWT authentication with RBAC - #22

DT-507: Implement production-ready Keycloak JWT authentication with RBAC#22
devajipatil wants to merge 12 commits into
developfrom
DT-507-backend

devajipatil commented Apr 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

devajipatil commented Apr 30, 2026

Overview

Key Changes

1. JWT Validation Improvements

2. Role-Based Access Control (RBAC)

3. New Auth Module Structure

4. API Security Changes

5. Swagger OAuth Improvements

Why This Change

Testing

Impact

Next Steps

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants