keycloak

Overview ¶

Package keycloak provides a Keycloak integration with two complementary clients:

• AdminClient: a service-account-backed wrapper around gocloak/v13 for user and realm-role lifecycle management. A service-account token is cached in-memory behind an RWMutex with double-check locking and refreshed on expiry with a configurable safety buffer (default 60 s). Safe for concurrent use.

• UMAClient: a stateless UMA 2.0 permission-decision client. Given an end-user access token, it calls the realm token endpoint with the uma-ticket grant type and decision response mode to answer a single resource#scope check.

Basic usage:

admin := keycloak.NewAdminClient(
    "https://kc.example.com",
    "my-realm",
    "svc-account",
    "svc-secret",
)

id, err := admin.CreateUser(ctx, keycloak.CreateUserParams{
    Username: "alice",
    Email:    "alice@example.com",
    Password: "s3cret",
})

uma := keycloak.NewUMAClient(
    "https://kc.example.com/realms/my-realm/protocol/openid-connect/token",
    "my-resource-server",
)

allowed, err := uma.Check(ctx, userToken, "document:42", "read")