🔐 Keycloak + OpenFGA + Kong による OIDC 認証・認可アーキテクチャ

services:
  postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: password
      POSTGRES_DB: postgres
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - auth-net

  keycloak:
    image: quay.io/keycloak/keycloak:26.1.0
    command: start-dev  # 開発用。本番では start を使用し、hostname-strict 等を設定する
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/postgres
      KC_DB_USERNAME: postgres
      KC_DB_PASSWORD: password
      KC_HTTP_PORT: 8080
      KC_SPI_EVENTS_LISTENER_OPENFGA_EVENTS_PUBLISHER_API_URL: http://openfga:8080
      KC_SPI_EVENTS_LISTENER_OPENFGA_EVENTS_PUBLISHER_STORE_ID: ${FGA_STORE_ID}
      KC_SPI_EVENTS_LISTENER_OPENFGA_EVENTS_PUBLISHER_AUTHORIZATION_MODEL_ID: ${FGA_MODEL_ID}
    volumes:
      - ./keycloak/providers:/opt/keycloak/providers
    ports:
      - "8080:8080"
    depends_on:
      - postgres
    networks:
      - auth-net

  openfga:
    image: openfga/openfga:v1.8
    command: run
    environment:
      OPENFGA_DATASTORE_ENGINE: postgres
      OPENFGA_DATASTORE_URI: postgres://postgres:password@postgres:5432/postgres?sslmode=disable
      OPENFGA_LOG_FORMAT: json
    ports:
      - "8081:8080"
      - "8082:8081"
      - "3000:3000"
    depends_on:
      - postgres
    networks:
      - auth-net

  kong:
    image: kong/kong-gateway:3.9
    environment:
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: /kong/declarative/kong.yml
      KONG_PROXY_LISTEN: "0.0.0.0:9000"
      KONG_ADMIN_LISTEN: "0.0.0.0:9001"
      KONG_LOG_LEVEL: info
    volumes:
      - ./kong:/kong/declarative
    ports:
      - "9000:9000"
      - "9001:9001"
    networks:
      - auth-net

  backend:
    image: your-backend:latest
    environment:
      FGA_API_URL: http://openfga:8080
      FGA_STORE_ID: ${FGA_STORE_ID}
      FGA_MODEL_ID: ${FGA_MODEL_ID}
    ports:
      - "8090:8090"
    networks:
      - auth-net

networks:
  auth-net:

volumes:
  postgres_data:

# OpenFGA のデータベースマイグレーション
docker compose up -d postgres
docker compose run --rm openfga migrate

# 全サービス起動
docker compose up -d

# Admin CLI でログイン
docker exec -it <keycloak-container> /opt/keycloak/bin/kcadm.sh \
  config credentials \
  --server http://localhost:8080 \
  --realm master \
  --user admin \
  --password admin

# Realm 作成
docker exec -it <keycloak-container> /opt/keycloak/bin/kcadm.sh \
  create realms \
  -s realm=myrealm \
  -s enabled=true

docker exec -it <keycloak-container> /opt/keycloak/bin/kcadm.sh \
  create clients \
  -r myrealm \
  -s clientId=my-spa \
  -s publicClient=true \
  -s "redirectUris=[\"http://localhost:3000/*\"]" \
  -s "webOrigins=[\"http://localhost:3000\"]" \
  -s protocol=openid-connect \
  -s attributes='{"pkce.code.challenge.method":"S256"}'

# ロール作成
docker exec -it <keycloak-container> /opt/keycloak/bin/kcadm.sh \
  create roles -r myrealm -s name=app-user

# ユーザー作成
docker exec -it <keycloak-container> /opt/keycloak/bin/kcadm.sh \
  create users -r myrealm -s username=alice -s enabled=true

# パスワード設定
docker exec -it <keycloak-container> /opt/keycloak/bin/kcadm.sh \
  set-password -r myrealm --username alice --new-password password

# ロール割り当て
docker exec -it <keycloak-container> /opt/keycloak/bin/kcadm.sh \
  add-roles -r myrealm --uusername alice --rolename app-user

# JAR をダウンロード
curl -L -o keycloak/providers/keycloak-openfga-event-publisher.jar \
  https://github.com/embesozzi/keycloak-openfga-event-publisher/releases/latest/download/keycloak-openfga-event-publisher.jar

# Keycloak を再起動して拡張機能を読み込む
docker compose restart keycloak

# Service 作成
curl -X POST http://localhost:9001/services \
  -d name=backend-service \
  -d url=http://backend:8090

# Route 作成
curl -X POST http://localhost:9001/services/backend-service/routes \
  -d name=backend-route \
  -d "paths[]=/api"

curl -X POST http://localhost:9001/services/backend-service/plugins \
  -H "Content-Type: application/json" \
  -d '{
    "name": "openid-connect",
    "config": {
      "issuer": "http://keycloak:8080/realms/myrealm",
      "client_id": "kong-client",
      "client_secret": "kong-client-secret",
      "auth_methods": ["bearer"],
      "bearer_token_param_type": ["header"],
      "token_endpoint_auth_method": "client_secret_post",
      "scopes": ["openid", "profile", "email"],
      "verify_signature": true,
      "verify_expiry": true,
      "upstream_access_token_header": "Authorization",
      "upstream_user_info_header": "X-Userinfo"
    }
  }'

curl -X POST http://localhost:9001/services/backend-service/plugins \
  -H "Content-Type: application/json" \
  -d '{
    "name": "cors",
    "config": {
      "origins": ["http://localhost:3000"],
      "methods": ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
      "headers": ["Content-Type", "Authorization"],
      "exposed_headers": ["X-Auth-Token"],
      "credentials": true,
      "max_age": 3600
    }
  }'

# FGA CLI のインストール
brew install openfga/tap/fga

# Store 作成
fga store create --name "my-app-store"

# 環境変数を設定する
export FGA_API_URL=http://localhost:8081
export FGA_STORE_ID=<取得した store.id>

cat > model.fga << 'EOF'
model
  schema 1.1

type user

type role
  relations
    define member: [user]

type document
  relations
    define owner: [user]
    define editor: [user, role#member]
    define viewer: [user, role#member]
    define can_write: editor or owner
    define can_view: viewer or editor or owner
EOF

fga model write --store-id=$FGA_STORE_ID --file model.fga

# ユーザーをロールメンバーとして追加する
fga tuple write --store-id=$FGA_STORE_ID user:alice member role:app-user

# ロールにドキュメント閲覧権限を付与する
fga tuple write --store-id=$FGA_STORE_ID role:app-user#member viewer document:readme

# ファイルで一括投入する
fga tuple write --store-id=$FGA_STORE_ID --file tuples.json

{
  "writes": [
    { "user": "user:alice", "relation": "owner", "object": "document:readme" },
    { "user": "user:bob", "relation": "viewer", "object": "document:readme" }
  ]
}

npm install oidc-spa

// src/oidc.ts
import { createOidc } from "oidc-spa/react";

export const { OidcProvider, useOidc, getOidc } = createOidc({
  issuerUri: "http://localhost:8080/realms/myrealm",
  clientId: "my-spa",
  scopes: ["openid", "profile", "email"],
  // PKCE は自動的に S256 で設定される
});

// src/main.tsx
import { OidcProvider } from "./oidc";

ReactDOM.createRoot(document.getElementById("root")!).render(
  <OidcProvider fallback={<div>Loading...</div>}>
    <App />
  </OidcProvider>
);

// src/components/ProtectedRoute.tsx
import { useOidc } from "../oidc";

export function ProtectedRoute({ children }: { children: React.ReactNode }) {
  const { isUserLoggedIn, login } = useOidc();

  if (!isUserLoggedIn) {
    login({ doesCurrentHrefRequiresAuth: true });
    return null;
  }

  return <>{children}</>;
}

// src/App.tsx
function App() {
  return (
    <Routes>
      <Route path="/" element={<Home />} />
      <Route
        path="/dashboard"
        element={
          <ProtectedRoute>
            <Dashboard />
          </ProtectedRoute>
        }
      />
    </Routes>
  );
}

// src/api/client.ts
import axios from "axios";
import { getOidc } from "../oidc";

const apiClient = axios.create({
  baseURL: "http://localhost:9000/api",
});

apiClient.interceptors.request.use(async (config) => {
  const oidc = await getOidc();
  if (oidc.isUserLoggedIn) {
    const { accessToken } = oidc.getTokens();
    config.headers.Authorization = `Bearer ${accessToken}`;
  }
  return config;
});

export default apiClient;

// src/hooks/useAuth.ts
import { useOidc } from "../oidc";
import { decodeJwt } from "oidc-spa/decode-jwt";

type KeycloakAccessTokenPayload = {
  realm_access?: { roles: string[] };
  resource_access?: Record<string, { roles: string[] }>;
  sub: string;
};

type UseAuthReturn =
  | {
      isAuthenticated: false;
      user: null;
      hasRole: (_roleName: string) => false;
      login: () => void;
    }
  | {
      isAuthenticated: true;
      user: { username: string; email: string; sub: string };
      hasRole: (roleName: string) => boolean;
      logout: (params?: { redirectTo?: string }) => void;
    };

export function useAuth(): UseAuthReturn {
  const oidc = useOidc();

  if (!oidc.isUserLoggedIn) {
    return {
      isAuthenticated: false,
      user: null,
      hasRole: () => false,
      login: () => oidc.login({ doesCurrentHrefRequiresAuth: true }),
    };
  }

  const { decodedIdToken, oidcTokens, logout } = oidc;
  const decoded = decodeJwt<KeycloakAccessTokenPayload>(
    oidcTokens.accessToken
  );
  const realmRoles = decoded.realm_access?.roles ?? [];

  return {
    isAuthenticated: true,
    user: {
      username: decodedIdToken.preferred_username,
      email: decodedIdToken.email,
      sub: decodedIdToken.sub,
    },
    hasRole: (roleName: string) => realmRoles.includes(roleName),
    logout,
  };
}

// src/components/RequireRole.tsx
import { type ReactNode } from "react";
import { useAuth } from "../hooks/useAuth";
import { Navigate } from "react-router-dom";

export function RequireRole({
  role,
  children,
  fallback = <Navigate to="/unauthorized" replace />,
}: {
  role: string;
  children: ReactNode;
  fallback?: ReactNode;
}): ReactNode {
  const auth = useAuth();

  if (!auth.isAuthenticated) {
    auth.login();
    return null;
  }

  if (!auth.hasRole(role)) {
    return fallback;
  }

  return children;
}

// ルーティングでの利用例
<Routes>
  <Route path="/dashboard" element={
    <RequireRole role="user"><DashboardPage /></RequireRole>
  } />
  <Route path="/admin" element={
    <RequireRole role="admin" fallback={<Navigate to="/dashboard" replace />}>
      <AdminPage />
    </RequireRole>
  } />
</Routes>

# リフレッシュトークンによるトークン更新（手動確認用）
curl -X POST http://localhost:8080/realms/myrealm/protocol/openid-connect/token \
  -d grant_type=refresh_token \
  -d client_id=my-spa \
  -d refresh_token=<refresh_token>

// フロントチャネルログアウト
const { logout } = useOidc();
await logout({ redirectTo: "http://localhost:3000" });

import express from "express";
import { createRemoteJWKSet, jwtVerify } from "jose";

const KEYCLOAK_ISSUER = "https://keycloak.example.com/realms/myrealm";
const JWKS = createRemoteJWKSet(
  new URL(`${KEYCLOAK_ISSUER}/protocol/openid-connect/certs`)
);

app.post("/backchannel-logout", async (req, res) => {
  const logoutToken: string = req.body.logout_token;

  const { payload } = await jwtVerify(logoutToken, JWKS, {
    issuer: KEYCLOAK_ISSUER,
  });

  const events = payload.events as Record<string, unknown>;
  if (events?.["http://schemas.openid.net/event/backchannel-logout"] == null) {
    return res.status(400).send("Invalid logout token");
  }

  const sid = payload.sid as string | undefined;
  const sub = payload.sub as string | undefined;
  if (sid != null) {
    await sessionStore.deleteBySessionId(sid);
  } else if (sub != null) {
    await sessionStore.deleteAllByUserId(sub);
  }

  return res.status(200).send("OK");
});

curl -X POST http://localhost:8081/stores/$FGA_STORE_ID/check \
  -H "Content-Type: application/json" \
  -d '{
    "authorization_model_id": "'$FGA_MODEL_ID'",
    "tuple_key": {
      "user": "user:alice",
      "relation": "can_view",
      "object": "document:readme"
    }
  }'
# レスポンス: {"allowed": true}

import { OpenFgaClient } from "@openfga/sdk";

const fgaClient = new OpenFgaClient({
  apiUrl: process.env.FGA_API_URL,
  storeId: process.env.FGA_STORE_ID,
  authorizationModelId: process.env.FGA_MODEL_ID,
});

async function checkPermission(
  userId: string,
  relation: string,
  objectId: string
): Promise<boolean> {
  const response = await fgaClient.check({
    tuple_key: {
      user: `user:${userId}`,
      relation,
      object: objectId,
    },
  });
  return response.allowed ?? false;
}

# Tuple 追加
fga tuple write --store-id=$FGA_STORE_ID user:alice editor document:report

# Tuple 削除
fga tuple delete --store-id=$FGA_STORE_ID user:alice editor document:report

curl -X POST http://localhost:8081/stores/$FGA_STORE_ID/write \
  -H "Content-Type: application/json" \
  -d '{
    "authorization_model_id": "'$FGA_MODEL_ID'",
    "writes": {
      "tuple_keys": [
        { "user": "user:alice", "relation": "editor", "object": "document:report" }
      ]
    },
    "deletes": {
      "tuple_keys": [
        { "user": "user:bob", "relation": "viewer", "object": "document:report" }
      ]
    }
  }'

# 新しいモデルを書き込む
fga model write --store-id=$FGA_STORE_ID --file model_v2.fga

# モデル一覧を確認する
fga model list --store-id=$FGA_STORE_ID

cat > model_multitenant.fga << 'EOF'
model
  schema 1.1

type user

type organization
  relations
    define member: [user]
    define admin: [user]
    define can_manage: admin

type folder
  relations
    define parent_folder: [folder]
    define owner: [user, organization#member] or owner from parent_folder
    define writer: [user, organization#member] or owner or writer from parent_folder
    define viewer: [user, organization#member] or writer or viewer from parent_folder

type document
  relations
    define organization: [organization]
    define parent_folder: [folder]
    define owner: [user, organization#member]
    define editor: [user, organization#member] or owner
    define viewer: [user, organization#member] or editor or viewer from parent_folder
    define can_view: viewer or viewer from parent_folder
    define can_edit: editor or admin from organization
EOF

fga model write --store-id=$FGA_STORE_ID --file model_multitenant.fga

cat > model_conditional.fga << 'EOF'
model
  schema 1.1

type user

type document
  relations
    define viewer: [user, user with non_expired_grant]

condition non_expired_grant(
  current_time: timestamp,
  grant_time: timestamp,
  grant_duration: duration
) {
  current_time < grant_time + grant_duration
}
EOF

curl -X POST http://localhost:8081/stores/$FGA_STORE_ID/check \
  -H "Content-Type: application/json" \
  -d '{
    "authorization_model_id": "'$FGA_MODEL_ID'",
    "tuple_key": {
      "user": "user:anne",
      "relation": "viewer",
      "object": "document:budget-2026"
    },
    "context": {
      "current_time": "2026-04-03T14:00:00Z"
    }
  }'

app.get("/resource", async (req, res) => {
  const userInfo = req.headers["x-userinfo"];
  const user = JSON.parse(Buffer.from(userInfo as string, "base64").toString());
  const userId = user.sub;

  const allowed = await checkPermission(userId, "can_view", "document:readme");
  if (!allowed) {
    return res.status(403).json({ error: "Forbidden" });
  }

  res.json({ data: "protected content" });
});

# エクスポート（ファイル）
bin/kc.sh export --file realm-export.json --realm myrealm

# エクスポート（ディレクトリ、ユーザー分割）
bin/kc.sh export --dir /export --realm myrealm \
  --users different_files --users-per-file 100

# インポート（既存 Realm を上書きしない）
bin/kc.sh import --dir /export --override false

# 起動時インポート（data/import ディレクトリを参照）
bin/kc.sh start --import-realm

# サービスアカウント（admin-cli の Service Accounts Enabled が必要）
TOKEN=$(curl -s -X POST \
  "http://keycloak:8080/realms/myrealm/protocol/openid-connect/token" \
  -d "client_id=admin-cli&grant_type=client_credentials&client_secret=SECRET" \
  | jq -r .access_token)

# ユーザー作成
curl -s -X POST \
  "http://keycloak:8080/admin/realms/myrealm/users" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username":"alice","enabled":true,"email":"alice@example.com"}'

# 1. 現行バージョンでメタデータ生成
bin/kc.sh update-compatibility metadata --file=/tmp/compat.json

# 2. 新バージョンで互換性チェック
bin/kc.sh update-compatibility check --file=/tmp/compat.json
# 終了コード 0: ローリングアップデート可能
# 終了コード 3: 全ノード停止が必要

# Kong 設定をエクスポート
deck gateway dump --output-file kong.yml

# 差分確認（ドライラン）
deck gateway diff kong.yml

# 設定同期（変更を Kong に適用）
deck gateway sync kong.yml

# OpenAPI Spec から kong.yml を生成
deck file openapi2kong --spec openapi.yml --output-file kong.yml

# kong.yml のアップストリーム定義例
upstreams:
  - name: backend-upstream
    algorithm: round-robin
    healthchecks:
      active:
        http_path: /health
        interval: 10
        healthy:
          successes: 2
        unhealthy:
          http_failures: 3
          interval: 5
      passive:
        healthy:
          successes: 5
        unhealthy:
          http_failures: 5
    targets:
      - target: backend-1:8080
        weight: 100
      - target: backend-2:8080
        weight: 100

# モデル一覧取得（新しい順）
curl -X GET "http://openfga:8080/stores/{store_id}/authorization-models"

openfga run \
  --metrics-enabled \
  --datastore-metrics-enabled \
  --trace-enabled \
  --trace-sample-ratio 0.1

curl -X POST \
  "http://keycloak:8080/realms/myrealm/protocol/openid-connect/revoke" \
  -d "client_id=spa-client" \
  -d "token=<refresh_token>" \
  -d "token_type_hint=refresh_token"

curl -X PUT \
  "http://keycloak:8080/admin/realms/myrealm/clients/{client-uuid}" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"attributes": {"pkce.code.challenge.method": "S256"}}'

plugins:
  - name: cors
    config:
      origins:
        - "https://app.example.com"
      methods:
        - GET
        - POST
        - PUT
        - DELETE
      headers:
        - Authorization
        - Content-Type
      credentials: true
      max_age: 3600

plugins:
  - name: response-transformer
    config:
      add:
        headers:
          - "Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://keycloak.example.com; frame-ancestors 'none'"
          - "X-Frame-Options: DENY"
          - "X-Content-Type-Options: nosniff"

import DOMPurify from "dompurify";

const SafeContent = ({ html }: { html: string }) => (
  <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }} />
);

curl -X PUT \
  "http://keycloak:8080/admin/realms/myrealm" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "bruteForceProtected": true,
    "failureFactor": 5,
    "waitIncrementSeconds": 60,
    "maxFailureWaitSeconds": 900,
    "maxDeltaTimeSeconds": 43200
  }'

export OPENFGA_AUTHN_METHOD=preshared
export OPENFGA_AUTHN_PRESHARED_KEYS=my-secret-key-1,my-secret-key-2

export OPENFGA_AUTHN_METHOD=oidc
export OPENFGA_AUTHN_OIDC_ISSUER=https://keycloak.example.com/realms/myrealm
export OPENFGA_AUTHN_OIDC_AUDIENCE=openfga-api

const checkResult = await fgaClient.check({
  tuple_key: {
    user: `user:${userId}`,
    relation: "viewer",
    object: `document:${docId}`,
  },
  contextual_tuples: {
    tuple_keys: token.groups.map((group: string) => ({
      user: `user:${userId}`,
      relation: "member",
      object: `group:${group}`,
    })),
  },
  authorization_model_id: currentModelId,
});

affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app: keycloak
        topologyKey: kubernetes.io/hostname

OPENFGA_MAX_CONCURRENT_READS_FOR_CHECK=100
OPENFGA_MAX_CONCURRENT_READS_FOR_LIST_OBJECTS=50
OPENFGA_RESOLVE_NODE_LIMIT=25
OPENFGA_LIST_OBJECTS_MAX_RESULTS=100

services:
  # 既存の postgres / keycloak / openfga / backend はそのまま

  redis:
    image: redis:7-alpine
    networks:
      - auth-net

  kong:
    image: ghcr.io/suwa-sh/kong-plugin-oidc:latest  # Kong OSS にプラグインを同梱したイメージ
    environment:
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: /kong/declarative/kong.yml
      KONG_PLUGINS: bundled,oidc                     # oidc プラグインを有効化
      KONG_PROXY_LISTEN: "0.0.0.0:9000"
      KONG_ADMIN_LISTEN: "0.0.0.0:9001"
      KONG_LOG_LEVEL: info
    volumes:
      - ./kong:/kong/declarative
    ports:
      - "9000:9000"
      - "9001:9001"
    depends_on:
      - keycloak
      - redis
    networks:
      - auth-net

curl -X POST http://localhost:9001/services/backend-service/plugins \
  -H "Content-Type: application/json" \
  -d '{
    "name": "oidc",
    "config": {
      "client_id": "kong-client",
      "client_secret": "kong-client-secret",
      "discovery": "http://keycloak:8080/realms/myrealm/.well-known/openid-configuration",
      "encryption_secret": "change-me-32bytes-base64xxxxxxxx",
      "bearer_jwt_auth_enable": "yes",
      "bearer_jwt_auth_allowed_auds": ["my-spa"],
      "bearer_jwt_auth_signing_algs": ["RS256"],
      "bearer_only": "yes",
      "session_storage": "redis",
      "session_redis_host": "redis",
      "session_redis_port": 6379,
      "groups_claim": "groups"
    }
  }'

_format_version: "3.0"
_transform: true

services:
  - name: backend-service
    url: http://backend:8090
    routes:
      - name: backend-route
        paths:
          - /api
    plugins:
      - name: oidc
        config:
          client_id: kong-client
          client_secret: kong-client-secret
          discovery: http://keycloak:8080/realms/myrealm/.well-known/openid-configuration
          encryption_secret: change-me-32bytes-base64xxxxxxxx
          bearer_jwt_auth_enable: "yes"
          bearer_jwt_auth_allowed_auds:
            - my-spa
          bearer_jwt_auth_signing_algs:
            - RS256
          bearer_only: "yes"
          session_storage: redis
          session_redis_host: redis
          session_redis_port: 6379
          groups_claim: groups