Keycloak-Tomcat-Adapter: Is there a alternative path for 'keycloak.json'?

Question

I try to secure my Java Servlet application with keycloak. All works fine but I don't like the fact that my 'keycloak.json' file is inside my release located. The reason is, if the keycloak definitions are inside my war, so I need for different installations different build processes or the same client credentials on different installations.

My idea was now to place the 'keycloak.json' outside my WEB-INF. Is this possible? Other ideas to solve this problem are also welcome.

Answer 1

if you check the KeycloakOIDCFilter you see there are three additional parameter.

• keycloak.config.resolver
• keycloak.config.file
• keycloak.config.path

We are using file parameter and works like charme.

Answer 2

The Servlet-Filter mentioned above is not necessary.

It is enough to set a context-parameter, like @OkieOth said in his comment.

E.g. set a Parameter like this

<Parameter name="keycloak.config.file" value="MY-PATH/keycloak.json" override="false"/>

within your context (beside the for keycloak configured Valve) or a "context-param" in your web application deployment descriptor (/WEB-INF/web.xml):

<context-param>
    <param-name>keycloak.config.file</param-name>
    <param-value>MY-PATH/keycloak.json</param-value>
</context-param>

For more Detail about context-params, see The Context Container in section "Context Parameters".