{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1516242622,
  "roles": ["USER", "ADMIN"]
}

HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secret
)

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.11.5</version>
</dependency>

@Component
public class JwtUtil {
    
    private final String SECRET_KEY = "mySecretKey";
    private final int EXPIRATION_TIME = 86400000; // 24 часа
    
    private Key getSigningKey() {
        byte[] keyBytes = SECRET_KEY.getBytes();
        return Keys.hmacShaKeyFor(keyBytes);
    }
}

public String generateToken(String username, List<String> roles) {
    Date now = new Date();
    Date expiration = new Date(now.getTime() + EXPIRATION_TIME);
    
    return Jwts.builder()
        .setSubject(username)
        .setIssuedAt(now)
        .setExpiration(expiration)
        .claim("roles", roles)
        .signWith(getSigningKey(), SignatureAlgorithm.HS256)
        .compact();
}

public Claims extractClaims(String token) {
    return Jwts.parserBuilder()
        .setSigningKey(getSigningKey())
        .build()
        .parseClaimsJws(token)
        .getBody();
}

public String extractUsername(String token) {
    return extractClaims(token).getSubject();
}

public boolean isTokenExpired(String token) {
    return extractClaims(token).getExpiration().before(new Date());
}

public boolean validateToken(String token) {
    try {
        Jwts.parserBuilder()
            .setSigningKey(getSigningKey())
            .build()
            .parseClaimsJws(token);
        return true;
    } catch (JwtException | IllegalArgumentException e) {
        return false;
    }
}

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    
    @Autowired
    private JwtUtil jwtUtil;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                  HttpServletResponse response, 
                                  FilterChain filterChain) throws ServletException, IOException {
        
        String authHeader = request.getHeader("Authorization");
        String token = null;
        String username = null;
        
        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            token = authHeader.substring(7);
            username = jwtUtil.extractUsername(token);
        }
        
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            if (jwtUtil.validateToken(token)) {
                UsernamePasswordAuthenticationToken authToken = 
                    new UsernamePasswordAuthenticationToken(username, null, getAuthorities(token));
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        
        filterChain.doFilter(request, response);
    }
    
    private Collection<? extends GrantedAuthority> getAuthorities(String token) {
        Claims claims = jwtUtil.extractClaims(token);
        List<String> roles = (List<String>) claims.get("roles");
        return roles.stream()
            .map(SimpleGrantedAuthority::new)
            .collect(Collectors.toList());
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    
    @Autowired
    private JwtAuthenticationFilter jwtAuthenticationFilter;
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .anyRequest().authenticated()
            )
            .sessionManagement(session -> 
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
        
        return http.build();
    }
}

@Service
public class AuthService {
    
    private final JwtUtil jwtUtil;
    private final RefreshTokenRepository refreshTokenRepository;
    
    public AuthResponse authenticate(LoginRequest request) {
        // Проверка учетных данных
        
        String accessToken = jwtUtil.generateToken(username, roles);
        String refreshToken = generateRefreshToken(username);
        
        return AuthResponse.builder()
            .accessToken(accessToken)
            .refreshToken(refreshToken)
            .build();
    }
    
    private String generateRefreshToken(String username) {
        String token = UUID.randomUUID().toString();
        RefreshToken refreshToken = RefreshToken.builder()
            .token(token)
            .username(username)
            .expiryDate(LocalDateTime.now().plusDays(7))
            .build();
        
        refreshTokenRepository.save(refreshToken);
        return token;
    }
    
    public AuthResponse refreshToken(String refreshToken) {
        RefreshToken storedToken = refreshTokenRepository.findByToken(refreshToken)
            .orElseThrow(() -> new TokenNotFoundException("Refresh token not found"));
        
        if (storedToken.getExpiryDate().isBefore(LocalDateTime.now())) {
            refreshTokenRepository.delete(storedToken);
            throw new TokenExpiredException("Refresh token expired");
        }
        
        String newAccessToken = jwtUtil.generateToken(storedToken.getUsername(), getUserRoles(storedToken.getUsername()));
        return AuthResponse.builder()
            .accessToken(newAccessToken)
            .refreshToken(refreshToken)
            .build();
    }
}

// Access Token - короткий срок (15-60 минут)
private final int ACCESS_TOKEN_EXPIRATION = 900000; // 15 минут

// Refresh Token - длительный срок (7-30 дней)
private final int REFRESH_TOKEN_EXPIRATION = 604800000; // 7 дней

@Value("${app.jwt.secret}")
private String jwtSecret;

@Value("${app.jwt.expiration}")
private int jwtExpiration;

public boolean validateToken(String token, String expectedAudience) {
    try {
        Claims claims = extractClaims(token);
        return !isTokenExpired(token) && 
               expectedAudience.equals(claims.getAudience());
    } catch (Exception e) {
        return false;
    }
}

@Service
public class TokenBlacklistService {
    
    private final RedisTemplate<String, String> redisTemplate;
    
    public void blacklistToken(String token) {
        Claims claims = jwtUtil.extractClaims(token);
        long ttl = claims.getExpiration().getTime() - System.currentTimeMillis();
        
        if (ttl > 0) {
            redisTemplate.opsForValue().set("blacklist:" + token, "true", ttl, TimeUnit.MILLISECONDS);
        }
    }
    
    public boolean isBlacklisted(String token) {
        return redisTemplate.hasKey("blacklist:" + token);
    }
}

@RestControllerAdvice
public class JwtExceptionHandler {
    
    @ExceptionHandler(ExpiredJwtException.class)
    public ResponseEntity<ErrorResponse> handleExpiredJwtException(ExpiredJwtException e) {
        ErrorResponse error = ErrorResponse.builder()
            .message("Token expired")
            .errorCode("JWT_EXPIRED")
            .timestamp(LocalDateTime.now())
            .build();
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(error);
    }
    
    @ExceptionHandler(MalformedJwtException.class)
    public ResponseEntity<ErrorResponse> handleMalformedJwtException(MalformedJwtException e) {
        ErrorResponse error = ErrorResponse.builder()
            .message("Invalid token format")
            .errorCode("JWT_MALFORMED")
            .timestamp(LocalDateTime.now())
            .build();
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(error);
    }
}

// Шаг 1: Перенаправление на Authorization Server
@GetMapping("/login")
public String login() {
    String authUrl = "https://auth-server.com/oauth/authorize?" +
        "response_type=code&" +
        "client_id=your_client_id&" +
        "redirect_uri=https://your-app.com/callback&" +
        "scope=read write&" +
        "state=random_state_value";
    
    return "redirect:" + authUrl;
}

// Шаг 2: Обработка callback с authorization code
@GetMapping("/callback")
public String callback(@RequestParam String code, @RequestParam String state) {
    // Валидация state parameter для защиты от CSRF
    if (!validateState(state)) {
        throw new SecurityException("Invalid state parameter");
    }
    
    // Обмен authorization code на access token
    String accessToken = exchangeCodeForToken(code);
    
    return "redirect:/dashboard";
}

// Прямое получение access token во frontend
// https://auth-server.com/oauth/authorize?
// response_type=token&
// client_id=your_client_id&
// redirect_uri=https://your-spa.com/callback&
// scope=read&
// state=random_state_value

// Токен возвращается в URL fragment
// https://your-spa.com/callback#access_token=TOKEN&token_type=Bearer&expires_in=3600

@PostMapping("/token")
public ResponseEntity<TokenResponse> getToken(@RequestBody PasswordGrantRequest request) {
    // Валидация учетных данных пользователя
    if (!userService.validateCredentials(request.getUsername(), request.getPassword())) {
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
    }
    
    // Генерация access token
    String accessToken = tokenService.generateAccessToken(request.getUsername());
    String refreshToken = tokenService.generateRefreshToken(request.getUsername());
    
    TokenResponse response = TokenResponse.builder()
        .accessToken(accessToken)
        .refreshToken(refreshToken)
        .tokenType("Bearer")
        .expiresIn(3600)
        .build();
    
    return ResponseEntity.ok(response);
}

@PostMapping("/token")
public ResponseEntity<TokenResponse> getClientToken(@RequestBody ClientCredentialsRequest request) {
    // Аутентификация клиента
    if (!clientService.validateClient(request.getClientId(), request.getClientSecret())) {
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
    }
    
    // Генерация access token для клиента
    String accessToken = tokenService.generateClientToken(request.getClientId(), request.getScope());
    
    TokenResponse response = TokenResponse.builder()
        .accessToken(accessToken)
        .tokenType("Bearer")
        .expiresIn(3600)
        .build();
    
    return ResponseEntity.ok(response);
}

@PostMapping("/refresh")
public ResponseEntity<TokenResponse> refreshToken(@RequestBody RefreshTokenRequest request) {
    // Валидация refresh token
    RefreshToken storedToken = refreshTokenService.findByToken(request.getRefreshToken());
    if (storedToken == null || storedToken.isExpired()) {
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
    }
    
    // Генерация нового access token
    String newAccessToken = tokenService.generateAccessToken(storedToken.getUserId());
    
    TokenResponse response = TokenResponse.builder()
        .accessToken(newAccessToken)
        .tokenType("Bearer")
        .expiresIn(3600)
        .build();
    
    return ResponseEntity.ok(response);
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-authorization-server</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

@Configuration
@EnableWebSecurity
public class AuthorizationServerConfig {
    
    @Bean
    public RegisteredClientRepository registeredClientRepository() {
        RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
            .clientId("messaging-client")
            .clientSecret("{noop}secret")
            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
            .redirectUri("http://127.0.0.1:8080/login/oauth2/code/messaging-client-oidc")
            .scope(OidcScopes.OPENID)
            .scope("message.read")
            .scope("message.write")
            .clientSettings(ClientSettings.builder()
                .requireAuthorizationConsent(true)
                .build())
            .build();
        
        return new InMemoryRegisteredClientRepository(registeredClient);
    }
    
    @Bean
    public JWKSource<SecurityContext> jwkSource() {
        KeyPair keyPair = generateRsaKey();
        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
        
        RSAKey rsaKey = new RSAKey.Builder(publicKey)
            .privateKey(privateKey)
            .keyID(UUID.randomUUID().toString())
            .build();
        
        JWKSet jwkSet = new JWKSet(rsaKey);
        return new ImmutableJWKSet<>(jwkSet);
    }
    
    @Bean
    public AuthorizationServerSettings authorizationServerSettings() {
        return AuthorizationServerSettings.builder()
            .issuer("http://localhost:9000")
            .build();
    }
}

@Bean
public OAuth2TokenCustomizer<JwtEncodingContext> tokenCustomizer() {
    return context -> {
        if (context.getTokenType().equals(OAuth2TokenType.ACCESS_TOKEN)) {
            Authentication principal = context.getPrincipal();
            Set<String> authorities = principal.getAuthorities().stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.toSet());
            
            context.getClaims().claim("roles", authorities);
            context.getClaims().claim("custom_claim", "custom_value");
        }
    };
}

@Configuration
@EnableWebSecurity
public class ResourceServerConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers(HttpMethod.GET, "/api/messages").hasAuthority("SCOPE_message.read")
                .requestMatchers(HttpMethod.POST, "/api/messages").hasAuthority("SCOPE_message.write")
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                )
            );
        
        return http.build();
    }
    
    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtGrantedAuthoritiesConverter authoritiesConverter = new JwtGrantedAuthoritiesConverter();
        authoritiesConverter.setAuthorityPrefix("SCOPE_");
        authoritiesConverter.setAuthoritiesClaimName("scope");
        
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(authoritiesConverter);
        return converter;
    }
}

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://localhost:9000
          # Альтернативно можно указать jwk-set-uri
          # jwk-set-uri: http://localhost:9000/.well-known/jwks.json

public enum OAuth2Scope {
    READ("read", "Read access to resources"),
    WRITE("write", "Write access to resources"),
    DELETE("delete", "Delete access to resources"),
    ADMIN("admin", "Administrative access");
    
    private final String value;
    private final String description;
    
    OAuth2Scope(String value, String description) {
        this.value = value;
        this.description = description;
    }
}

@RestController
@RequestMapping("/api/messages")
public class MessageController {
    
    @GetMapping
    @PreAuthorize("hasAuthority('SCOPE_message.read')")
    public List<Message> getMessages() {
        return messageService.getAllMessages();
    }
    
    @PostMapping
    @PreAuthorize("hasAuthority('SCOPE_message.write')")
    public Message createMessage(@RequestBody Message message) {
        return messageService.createMessage(message);
    }
}

@Service
public class PKCEService {
    
    public PKCEChallenge generatePKCEChallenge() {
        // Генерация code verifier (случайная строка 43-128 символов)
        String codeVerifier = generateRandomString(128);
        
        // Создание code challenge (SHA256 hash + base64url encoding)
        String codeChallenge = base64UrlEncode(sha256(codeVerifier));
        
        return PKCEChallenge.builder()
            .codeVerifier(codeVerifier)
            .codeChallenge(codeChallenge)
            .codeChallengeMethod("S256")
            .build();
    }
    
    public boolean validatePKCE(String codeVerifier, String codeChallenge) {
        String computedChallenge = base64UrlEncode(sha256(codeVerifier));
        return computedChallenge.equals(codeChallenge);
    }
    
    private String generateRandomString(int length) {
        SecureRandom random = new SecureRandom();
        byte[] bytes = new byte[length];
        random.nextBytes(bytes);
        return base64UrlEncode(bytes);
    }
}

@RestController
public class UserInfoController {
    
    @GetMapping("/userinfo")
    public ResponseEntity<UserInfo> getUserInfo(Authentication authentication) {
        if (authentication instanceof JwtAuthenticationToken) {
            JwtAuthenticationToken token = (JwtAuthenticationToken) authentication;
            Jwt jwt = token.getToken();
            
            UserInfo userInfo = UserInfo.builder()
                .sub(jwt.getSubject())
                .name(jwt.getClaimAsString("name"))
                .email(jwt.getClaimAsString("email"))
                .emailVerified(jwt.getClaimAsBoolean("email_verified"))
                .picture(jwt.getClaimAsString("picture"))
                .build();
            
            return ResponseEntity.ok(userInfo);
        }
        
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
    }
}

public class OidcScopes {
    public static final String OPENID = "openid";      // Обязательный для OIDC
    public static final String PROFILE = "profile";    // Базовая информация профиля
    public static final String EMAIL = "email";        // Email и email_verified
    public static final String ADDRESS = "address";    // Адрес пользователя
    public static final String PHONE = "phone";        // Номер телефона
}

@Component
public class OAuth2SecurityService {
    
    // Защита от CSRF через state parameter
    public String generateState() {
        return UUID.randomUUID().toString();
    }
    
    public boolean validateState(String receivedState, String expectedState) {
        return receivedState != null && receivedState.equals(expectedState);
    }
    
    // Защита от replay attacks
    public boolean validateNonce(String nonce, String storedNonce) {
        return nonce != null && nonce.equals(storedNonce);
    }
    
    // Валидация redirect URI
    public boolean validateRedirectUri(String redirectUri, List<String> allowedRedirectUris) {
        return allowedRedirectUris.contains(redirectUri);
    }
    
    // Ограничение времени жизни authorization code
    public boolean isAuthorizationCodeExpired(AuthorizationCode code) {
        return code.getExpiresAt().isBefore(LocalDateTime.now());
    }
}

@Configuration
public class OAuth2ClientConfig {
    
    @Bean
    public ClientRegistrationRepository clientRegistrationRepository() {
        return new InMemoryClientRegistrationRepository(
            googleClientRegistration(),
            githubClientRegistration()
        );
    }
    
    private ClientRegistration googleClientRegistration() {
        return ClientRegistration.withRegistrationId("google")
            .clientId("your-google-client-id")
            .clientSecret("your-google-client-secret")
            .scope("openid", "profile", "email")
            .authorizationUri("https://accounts.google.com/o/oauth2/v2/auth")
            .tokenUri("https://oauth2.googleapis.com/token")
            .userInfoUri("https://openidconnect.googleapis.com/v1/userinfo")
            .userNameAttributeName(IdTokenClaimNames.SUB)
            .jwkSetUri("https://www.googleapis.com/oauth2/v3/certs")
            .clientName("Google")
            .build();
    }
}

@Controller
public class OAuth2LoginController {
    
    @GetMapping("/login/oauth2/callback")
    public String oauth2LoginCallback(OAuth2AuthenticationToken authentication) {
        OAuth2User user = authentication.getPrincipal();
        
        // Извлечение информации о пользователе
        String email = user.getAttribute("email");
        String name = user.getAttribute("name");
        String providerId = user.getAttribute("sub");
        
        // Создание или обновление пользователя в системе
        User systemUser = userService.createOrUpdateUser(email, name, providerId);
        
        // Генерация собственного JWT токена
        String jwtToken = jwtService.generateToken(systemUser);
        
        return "redirect:/dashboard?token=" + jwtToken;
    }
}

version: '3.8'
services:
  keycloak:
    image: quay.io/keycloak/keycloak:22.0
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: password
    ports:

      - "8080:8080"
    command: start-dev
    depends_on:

      - postgres
    
  postgres:
    image: postgres:15
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: password
    volumes:

      - postgres_data:/var/lib/postgresql/data

volumes:
  postgres_data:

# Переменные окружения для production
export KC_DB=postgres
export KC_DB_URL=jdbc:postgresql://localhost/keycloak
export KC_DB_USERNAME=keycloak
export KC_DB_PASSWORD=password
export KC_HOSTNAME=auth.yourcompany.com
export KC_HTTPS_CERTIFICATE_FILE=/path/to/cert.pem
export KC_HTTPS_CERTIFICATE_KEY_FILE=/path/to/key.pem

# Запуск в production режиме
./kc.sh start --optimized

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>
<dependency>
    <groupId>org.keycloak</groupId>
    <artifactId>keycloak-spring-boot-starter</artifactId>
    <version>22.0.1</version>
</dependency>

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://localhost:8080/realms/my-realm
          jwk-set-uri: http://localhost:8080/realms/my-realm/protocol/openid-connect/certs
      client:
        registration:
          keycloak:
            client-id: my-app
            client-secret: your-client-secret
            scope: openid,profile,email
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
        provider:
          keycloak:
            issuer-uri: http://localhost:8080/realms/my-realm
            user-name-attribute: preferred_username

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true)
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/api/user/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                )
            )
            .oauth2Login(oauth2 -> oauth2
                .defaultSuccessUrl("/dashboard", true)
            );
        
        return http.build();
    }
    
    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtGrantedAuthoritiesConverter authoritiesConverter = new JwtGrantedAuthoritiesConverter();
        authoritiesConverter.setAuthorityPrefix("ROLE_");
        authoritiesConverter.setAuthoritiesClaimName("realm_access.roles");
        
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(authoritiesConverter);
        return converter;
    }
}

@Service
public class KeycloakUserService {
    
    @Value("${keycloak.auth-server-url}")
    private String serverUrl;
    
    @Value("${keycloak.realm}")
    private String realm;
    
    @Value("${keycloak.resource}")
    private String clientId;
    
    @Value("${keycloak.credentials.secret}")
    private String clientSecret;
    
    private Keycloak getKeycloakInstance() {
        return KeycloakBuilder.builder()
            .serverUrl(serverUrl)
            .realm("master")  // Используем master realm для админ операций
            .clientId("admin-cli")
            .username("admin")
            .password("admin")
            .build();
    }
    
    public String createUser(UserCreateRequest request) {
        Keycloak keycloak = getKeycloakInstance();
        
        UserRepresentation user = new UserRepresentation();
        user.setUsername(request.getUsername());
        user.setEmail(request.getEmail());
        user.setFirstName(request.getFirstName());
        user.setLastName(request.getLastName());
        user.setEnabled(true);
        user.setEmailVerified(true);
        
        // Создание пользователя
        Response response = keycloak.realm(realm)
            .users()
            .create(user);
        
        if (response.getStatus() == 201) {
            String userId = getCreatedId(response);
            
            // Установка пароля
            CredentialRepresentation credential = new CredentialRepresentation();
            credential.setType(CredentialRepresentation.PASSWORD);
            credential.setValue(request.getPassword());
            credential.setTemporary(false);
            
            keycloak.realm(realm)
                .users()
                .get(userId)
                .resetPassword(credential);
            
            return userId;
        }
        
        throw new RuntimeException("Failed to create user");
    }
    
    public void assignRoleToUser(String userId, String roleName) {
        Keycloak keycloak = getKeycloakInstance();
        
        RoleRepresentation role = keycloak.realm(realm)
            .roles()
            .get(roleName)
            .toRepresentation();
        
        keycloak.realm(realm)
            .users()
            .get(userId)
            .roles()
            .realmLevel()
            .add(Collections.singletonList(role));
    }
}

// Пример кастомного Token Mapper через SPI
public class CustomTokenMapper implements ProtocolMapper, OIDCAccessTokenMapper {
    
    public static final String PROVIDER_ID = "custom-token-mapper";
    
    @Override
    public String getProtocol() {
        return OIDCLoginProtocol.LOGIN_PROTOCOL;
    }
    
    @Override
    public String getDisplayType() {
        return "Custom Token Mapper";
    }
    
    @Override
    public AccessToken transformAccessToken(AccessToken token, 
                                          ProtocolMapperModel mappingModel, 
                                          KeycloakSession session,
                                          UserSessionModel userSession, 
                                          ClientSessionContext clientSessionCtx) {
        
        UserModel user = userSession.getUser();
        
        // Добавление кастомных claims
        token.getOtherClaims().put("department", user.getFirstAttribute("department"));
        token.getOtherClaims().put("employee_id", user.getFirstAttribute("employeeId"));
        
        // Добавление ролей из внешней системы
        List<String> externalRoles = getExternalRoles(user.getUsername());
        token.getOtherClaims().put("external_roles", externalRoles);
        
        return token;
    }
}

// Добавление пользовательских атрибутов через REST API
public void addUserAttributes(String userId, Map<String, String> attributes) {
    Keycloak keycloak = getKeycloakInstance();
    
    UserRepresentation user = keycloak.realm(realm)
        .users()
        .get(userId)
        .toRepresentation();
    
    if (user.getAttributes() == null) {
        user.setAttributes(new HashMap<>());
    }
    
    attributes.forEach((key, value) -> 
        user.getAttributes().put(key, Collections.singletonList(value))
    );
    
    keycloak.realm(realm)
        .users()
        .get(userId)
        .update(user);
}

{
  "id": "ldap-provider",
  "displayName": "Corporate LDAP",
  "providerId": "ldap",
  "providerType": "org.keycloak.storage.UserStorageProvider",
  "config": {
    "connectionUrl": ["ldap://ldap.company.com:389"],
    "usersDn": ["ou=users,dc=company,dc=com"],
    "bindDn": ["cn=admin,dc=company,dc=com"],
    "bindCredential": ["admin-password"],
    "userObjectClasses": ["inetOrgPerson"],
    "usernameLDAPAttribute": ["uid"],
    "emailLDAPAttribute": ["mail"],
    "firstNameLDAPAttribute": ["givenName"],
    "lastNameLDAPAttribute": ["sn"]
  }
}

// Конфигурация Google Identity Provider через Admin API
public void configureGoogleProvider() {
    Keycloak keycloak = getKeycloakInstance();
    
    IdentityProviderRepresentation provider = new IdentityProviderRepresentation();
    provider.setAlias("google");
    provider.setProviderId("google");
    provider.setEnabled(true);
    provider.setTrustEmail(true);
    provider.setStoreToken(false);
    
    Map<String, String> config = new HashMap<>();
    config.put("clientId", "your-google-client-id");
    config.put("clientSecret", "your-google-client-secret");
    config.put("defaultScope", "openid profile email");
    
    provider.setConfig(config);
    
    keycloak.realm(realm)
        .identityProviders()
        .create(provider);
}

@RestController
@RequestMapping("/api/documents")
public class DocumentController {
    
    @Autowired
    private KeycloakAuthorizationService authorizationService;
    
    @GetMapping("/{documentId}")
    public ResponseEntity<Document> getDocument(@PathVariable String documentId,
                                               Authentication authentication) {
        
        // Проверка разрешений через Keycloak Policy Decision Point
        AuthorizationRequest authRequest = AuthorizationRequest.builder()
            .resource("document")
            .resourceId(documentId)
            .scope("read")
            .accessToken(getAccessToken(authentication))
            .build();
        
        AuthorizationResponse authResponse = authorizationService.authorize(authRequest);
        
        if (authResponse.isAuthorized()) {
            Document document = documentService.getDocument(documentId);
            return ResponseEntity.ok(document);
        } else {
            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
        }
    }
}

// Создание ресурса и политик через Admin API
public void createResourceWithPolicies() {
    Keycloak keycloak = getKeycloakInstance();
    
    // Создание ресурса
    ResourceRepresentation resource = new ResourceRepresentation();
    resource.setName("sensitive-document");
    resource.setDisplayName("Sensitive Document");
    resource.setUri("/api/documents/sensitive/*");
    resource.setScopes(Set.of(
        new ScopeRepresentation("read"),
        new ScopeRepresentation("write"),
        new ScopeRepresentation("delete")
    ));
    
    // Создание роль-based политики
    RolePolicyRepresentation rolePolicy = new RolePolicyRepresentation();
    rolePolicy.setName("manager-policy");
    rolePolicy.addRole("manager");
    rolePolicy.setLogic(Logic.POSITIVE);
    
    // Создание time-based политики
    TimePolicyRepresentation timePolicy = new TimePolicyRepresentation();
    timePolicy.setName("business-hours-policy");
    timePolicy.setNotBefore("09:00:00");
    timePolicy.setNotOnOrAfter("18:00:00");
    
    // Создание permission
    ResourcePermissionRepresentation permission = new ResourcePermissionRepresentation();
    permission.setName("sensitive-document-permission");
    permission.addResource("sensitive-document");
    permission.addPolicy("manager-policy");
    permission.addPolicy("business-hours-policy");
    permission.setDecisionStrategy(DecisionStrategy.UNANIMOUS);
}

@Component
public class CustomEventListener implements EventListenerProvider {
    
    private static final Logger logger = LoggerFactory.getLogger(CustomEventListener.class);
    
    @Override
    public void onEvent(Event event) {
        switch (event.getType()) {
            case LOGIN:
                handleLoginEvent(event);
                break;
            case LOGIN_ERROR:
                handleLoginError(event);
                break;
            case LOGOUT:
                handleLogoutEvent(event);
                break;
            case UPDATE_PASSWORD:
                handlePasswordUpdate(event);
                break;
        }
    }
    
    private void handleLoginEvent(Event event) {
        String userId = event.getUserId();
        String ipAddress = event.getIpAddress();
        String clientId = event.getClientId();
        
        // Логирование успешного входа
        logger.info("User {} logged in from {} to client {}", userId, ipAddress, clientId);
        
        // Отправка в систему мониторинга
        auditService.recordLoginEvent(userId, ipAddress, clientId);
        
        // Проверка на подозрительную активность
        if (securityService.isSuspiciousLogin(userId, ipAddress)) {
            securityService.triggerSecurityAlert(userId, ipAddress);
        }
    }
    
    private void handleLoginError(Event event) {
        String error = event.getError();
        String username = event.getDetails().get(Details.USERNAME);
        String ipAddress = event.getIpAddress();
        
        logger.warn("Login failed for user {} from {}: {}", username, ipAddress, error);
        
        // Подсчет неудачных попыток для защиты от брут-форса
        bruteForceService.recordFailedAttempt(username, ipAddress);
    }
}

<!-- login.ftl - кастомная страница логина -->
<#import "template.ftl" as layout>
<@layout.registrationLayout displayInfo=social.displayInfo displayWide=(realm.password && social.providers??); section>
    <#if section = "header">
        ${msg("doLogIn")}
    <#elseif section = "form">
        <div id="kc-form" <#if realm.password && social.providers??>class="${properties.kcContentWrapperClass!}"</#if>>
            <div id="kc-form-wrapper" <#if realm.password && social.providers??>class="${properties.kcFormSocialAccountContentClass!} ${properties.kcFormSocialAccountClass!}"</#if>>
                <#if realm.password>
                    <form id="kc-form-login" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
                        <div class="company-logo">
                            <img src="${url.resourcesPath}/img/company-logo.png" alt="Company Logo" />
                        </div>
                        
                        <div class="${properties.kcFormGroupClass!}">
                            <label for="username" class="${properties.kcLabelClass!}">
                                <#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if>
                            </label>
                            <input tabindex="1" id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')}" type="text" autofocus autocomplete="off" />
                        </div>

                        <div class="${properties.kcFormGroupClass!}">
                            <label for="password" class="${properties.kcLabelClass!}">${msg("password")}</label>
                            <input tabindex="2" id="password" class="${properties.kcInputClass!}" name="password" type="password" autocomplete="off" />
                        </div>

                        <div class="${properties.kcFormGroupClass!} ${properties.kcFormSettingClass!}">
                            <div id="kc-form-options">
                                <#if realm.rememberMe && !usernameEditDisabled??>
                                    <div class="checkbox">
                                        <label>
                                            <#if login.rememberMe??>
                                                <input tabindex="3" id="rememberMe" name="rememberMe" type="checkbox" checked> ${msg("rememberMe")}
                                            <#else>
                                                <input tabindex="3" id="rememberMe" name="rememberMe" type="checkbox"> ${msg("rememberMe")}
                                            </#if>
                                        </label>
                                    </div>
                                </#if>
                            </div>
                        </div>

                        <div id="kc-form-buttons" class="${properties.kcFormGroupClass!}">
                            <input type="hidden" id="id-hidden-input" name="credentialId" <#if auth.selectedCredential?has_content>value="${auth.selectedCredential}"</#if>/>
                            <input tabindex="4" class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}" name="login" id="kc-login" type="submit" value="${msg("doLogIn")}"/>
                        </div>
                    </form>
                </#if>
            </div>
        </div>
    </#elseif>
</@layout.registrationLayout>

# docker-compose для кластера Keycloak
version: '3.8'
services:
  keycloak-1:
    image: quay.io/keycloak/keycloak:22.0
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: password
      KC_CACHE: ispn
      KC_CACHE_STACK: tcp
      JGROUPS_DISCOVERY_PROTOCOL: JDBC_PING
    ports:

      - "8080:8080"
    
  keycloak-2:
    image: quay.io/keycloak/keycloak:22.0
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: password
      KC_CACHE: ispn
      KC_CACHE_STACK: tcp
      JGROUPS_DISCOVERY_PROTOCOL: JDBC_PING
    ports:

      - "8081:8080"
    
  nginx:
    image: nginx:alpine
    ports:

      - "80:80"
    volumes:

      - ./nginx.conf:/etc/nginx/nginx.conf

// Кастомные метрики для мониторинга Keycloak
@Component
public class KeycloakMetrics {
    
    private final MeterRegistry meterRegistry;
    private final Counter loginSuccessCounter;
    private final Counter loginFailureCounter;
    private final Timer tokenGenerationTimer;
    
    public KeycloakMetrics(MeterRegistry meterRegistry) {
        this.meterRegistry = meterRegistry;
        this.loginSuccessCounter = Counter.builder("keycloak.login.success")
            .description("Number of successful logins")
            .register(meterRegistry);
        
        this.loginFailureCounter = Counter.builder("keycloak.login.failure")
            .description("Number of failed logins")
            .register(meterRegistry);
        
        this.tokenGenerationTimer = Timer.builder("keycloak.token.generation")
            .description("Time taken to generate tokens")
            .register(meterRegistry);
    }
    
    public void recordSuccessfulLogin(String realm, String client) {
        loginSuccessCounter.increment(
            Tags.of("realm", realm, "client", client)
        );
    }
    
    public void recordFailedLogin(String realm, String error) {
        loginFailureCounter.increment(
            Tags.of("realm", realm, "error", error)
        );
    }
}

// Упрощенная схема TLS Handshake
public class TLSHandshakeProcess {
    
    // 1. Client Hello - клиент отправляет поддерживаемые версии TLS и cipher suites
    public ClientHello sendClientHello() {
        return ClientHello.builder()
            .tlsVersion(TLSVersion.TLS_1_3)
            .cipherSuites(Arrays.asList("TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256"))
            .random(generateClientRandom())
            .build();
    }
    
    // 2. Server Hello - сервер выбирает версию TLS и cipher suite
    public ServerHello sendServerHello(ClientHello clientHello) {
        return ServerHello.builder()
            .selectedTlsVersion(TLSVersion.TLS_1_3)
            .selectedCipherSuite("TLS_AES_256_GCM_SHA384")
            .random(generateServerRandom())
            .certificate(loadServerCertificate())
            .build();
    }
    
    // 3. Key Exchange - согласование ключей шифрования
    public void performKeyExchange() {
        // В TLS 1.3 используется Elliptic Curve Diffie-Hellman
        ECDHKeyPair clientKeyPair = generateECDHKeyPair();
        ECDHKeyPair serverKeyPair = generateECDHKeyPair();
        
        // Обмен публичными ключами и вычисление общего секрета
        byte[] sharedSecret = computeSharedSecret(clientKeyPair.getPrivateKey(), 
                                                 serverKeyPair.getPublicKey());
        
        // Генерация симметричных ключей для шифрования данных
        SymmetricKeys symmetricKeys = deriveKeys(sharedSecret);
    }
}

// Работа с сертификатами в Java
public class CertificateManager {
    
    public X509Certificate loadCertificate(String certificatePath) throws Exception {
        CertificateFactory factory = CertificateFactory.getInstance("X.509");
        FileInputStream fis = new FileInputStream(certificatePath);
        X509Certificate certificate = (X509Certificate) factory.generateCertificate(fis);
        
        return certificate;
    }
    
    public boolean verifyCertificate(X509Certificate certificate, X509Certificate caCertificate) {
        try {
            // Проверка подписи сертификата
            certificate.verify(caCertificate.getPublicKey());
            
            // Проверка срока действия
            certificate.checkValidity();
            
            // Проверка отзыва через OCSP или CRL
            return !isCertificateRevoked(certificate);
            
        } catch (Exception e) {
            return false;
        }
    }
    
    public void validateCertificateChain(X509Certificate[] chain) throws Exception {
        for (int i = 0; i < chain.length - 1; i++) {
            X509Certificate current = chain[i];
            X509Certificate issuer = chain[i + 1];
            
            // Проверка, что следующий сертификат является издателем текущего
            current.verify(issuer.getPublicKey());
            
            // Проверка валидности
            current.checkValidity();
        }
    }
}

server:
  port: 8443
  ssl:
    key-store: classpath:keystore.p12
    key-store-password: password
    key-store-type: PKCS12
    key-alias: tomcat
    # Принудительное использование HTTPS
    enabled: true
  # Редирект с HTTP на HTTPS
  http2:
    enabled: true

# Настройки безопасности
spring:
  security:
    require-ssl: true

@Configuration
public class SSLConfig {
    
    @Bean
    public ServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() {
            @Override
            protected void postProcessContext(Context context) {
                SecurityConstraint securityConstraint = new SecurityConstraint();
                securityConstraint.setUserConstraint("CONFIDENTIAL");
                SecurityCollection collection = new SecurityCollection();
                collection.addPattern("/*");
                securityConstraint.addCollection(collection);
                context.addConstraint(securityConstraint);
            }
        };
        
        // Добавление HTTP коннектора для редиректа на HTTPS
        tomcat.addAdditionalTomcatConnectors(redirectConnector());
        return tomcat;
    }
    
    private Connector redirectConnector() {
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("http");
        connector.setPort(8080);
        connector.setSecure(false);
        connector.setRedirectPort(8443);
        return connector;
    }
    
    @Bean
    public SSLContext customSSLContext() throws Exception {
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        keyStore.load(new FileInputStream("keystore.p12"), "password".toCharArray());
        
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(keyStore, "password".toCharArray());
        
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(keyStore);
        
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom());
        
        return sslContext;
    }
}

# Генерация keystore с самоподписанным сертификатом для разработки
keytool -genkeypair -alias tomcat -keyalg RSA -keysize 2048 -storetype PKCS12 \
  -keystore keystore.p12 -validity 3650 -storepass password \
  -dname "CN=localhost,OU=Development,O=Company,L=City,ST=State,C=US"

# Экспорт сертификата в PEM формате
keytool -exportcert -alias tomcat -keystore keystore.p12 -storetype PKCS12 \
  -storepass password -rfc -file certificate.pem

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .requiresChannel(channel -> 
                channel.requestMatchers(r -> r.getHeader("X-Forwarded-Proto") != null)
                       .requiresSecure())
            .headers(headers -> headers
                // Принудительное использование HTTPS
                .httpStrictTransportSecurity(hstsConfig -> hstsConfig
                    .maxAgeInSeconds(31536000)
                    .includeSubdomains(true)
                    .preload(true)
                )
                // Защита от clickjacking
                .frameOptions().deny()
                // Защита от MIME type sniffing
                .contentTypeOptions().and()
                // Защита от XSS
                .httpPublicKeyPinning(hpkpConfig -> hpkpConfig
                    .withPins("sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
                    .maxAgeInSeconds(5184000)
                )
            );
        
        return http.build();
    }
    
    @Bean
    public FilterRegistrationBean<SecurityHeadersFilter> securityHeadersFilter() {
        FilterRegistrationBean<SecurityHeadersFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(new SecurityHeadersFilter());
        registrationBean.addUrlPatterns("/*");
        return registrationBean;
    }
}

@Component
public class SecurityHeadersFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        
        // Content Security Policy
        httpResponse.setHeader("Content-Security-Policy", 
            "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'");
        
        // Referrer Policy
        httpResponse.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
        
        // Feature Policy
        httpResponse.setHeader("Permissions-Policy", 
            "camera=(), microphone=(), geolocation=()");
        
        chain.doFilter(request, response);
    }
}

@Service
public class HttpsClientService {
    
    private final RestTemplate restTemplate;
    
    public HttpsClientService() throws Exception {
        this.restTemplate = createSecureRestTemplate();
    }
    
    private RestTemplate createSecureRestTemplate() throws Exception {
        // Загрузка truststore с доверенными сертификатами
        KeyStore trustStore = KeyStore.getInstance("PKCS12");
        trustStore.load(new FileInputStream("truststore.p12"), "password".toCharArray());
        
        // Настройка SSL контекста
        SSLContext sslContext = SSLContextBuilder
            .create()
            .loadTrustMaterial(trustStore, new TrustSelfSignedStrategy())
            .build();
        
        // Создание HTTP клиента с SSL
        CloseableHttpClient httpClient = HttpClients.custom()
            .setSSLContext(sslContext)
            .setSSLHostnameVerifier(new DefaultHostnameVerifier())
            .build();
        
        HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory();
        factory.setHttpClient(httpClient);
        
        return new RestTemplate(factory);
    }
    
    // Настройка для взаимной аутентификации (mTLS)
    private RestTemplate createMutualTLSRestTemplate() throws Exception {
        // Загрузка клиентского сертификата
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        keyStore.load(new FileInputStream("client.p12"), "password".toCharArray());
        
        // Загрузка truststore
        KeyStore trustStore = KeyStore.getInstance("PKCS12");
        trustStore.load(new FileInputStream("truststore.p12"), "password".toCharArray());
        
        SSLContext sslContext = SSLContextBuilder
            .create()
            .loadKeyMaterial(keyStore, "password".toCharArray())
            .loadTrustMaterial(trustStore, null)
            .build();
        
        CloseableHttpClient httpClient = HttpClients.custom()
            .setSSLContext(sslContext)
            .build();
        
        HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory();
        factory.setHttpClient(httpClient);
        
        return new RestTemplate(factory);
    }
    
    public String makeSecureRequest(String url) {
        HttpHeaders headers = new HttpHeaders();
        headers.set("User-Agent", "SecureApp/1.0");
        
        HttpEntity<String> entity = new HttpEntity<>(headers);
        ResponseEntity<String> response = restTemplate.exchange(url, HttpMethod.GET, entity, String.class);
        
        return response.getBody();
    }
}

@Component
public class CertificatePinningService {
    
    private static final String EXPECTED_PIN = "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
    
    public RestTemplate createPinnedRestTemplate() throws Exception {
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, new TrustManager[]{new PinningTrustManager()}, new SecureRandom());
        
        CloseableHttpClient httpClient = HttpClients.custom()
            .setSSLContext(sslContext)
            .build();
        
        HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory();
        factory.setHttpClient(httpClient);
        
        return new RestTemplate(factory);
    }
    
    private class PinningTrustManager implements X509TrustManager {
        
        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
            // Стандартная проверка цепочки сертификатов
            X509TrustManager defaultTrustManager = getDefaultTrustManager();
            defaultTrustManager.checkServerTrusted(chain, authType);
            
            // Дополнительная проверка pinning
            boolean pinMatched = false;
            for (X509Certificate cert : chain) {
                String pin = calculatePin(cert);
                if (EXPECTED_PIN.equals(pin)) {
                    pinMatched = true;
                    break;
                }
            }
            
            if (!pinMatched) {
                throw new CertificateException("Certificate pin verification failed");
            }
        }
        
        private String calculatePin(X509Certificate certificate) {
            try {
                MessageDigest digest = MessageDigest.getInstance("SHA-256");
                byte[] publicKeyBytes = certificate.getPublicKey().getEncoded();
                byte[] hash = digest.digest(publicKeyBytes);
                return "sha256/" + Base64.getEncoder().encodeToString(hash);
            } catch (Exception e) {
                throw new RuntimeException("Failed to calculate certificate pin", e);
            }
        }
    }
}

@Service
public class CertificateRenewalService {
    
    @Scheduled(fixedRate = 86400000) // Проверка каждые 24 часа
    public void checkCertificateExpiration() {
        try {
            X509Certificate certificate = loadCurrentCertificate();
            Date expirationDate = certificate.getNotAfter();
            Date now = new Date();
            
            // Обновление за 30 дней до истечения
            long daysUntilExpiration = (expirationDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24);
            
            if (daysUntilExpiration < 30) {
                renewCertificate();
            }
        } catch (Exception e) {
            log.error("Failed to check certificate expiration", e);
        }
    }
    
    private void renewCertificate() throws Exception {
        // Интеграция с ACME протоколом для Let's Encrypt
        AcmeClient acmeClient = new AcmeClient("https://acme-v02.api.letsencrypt.org/directory");
        
        // Генерация нового ключа
        KeyPair keyPair = generateKeyPair();
        
        // Создание заявки на сертификат
        CertificateRequest request = CertificateRequest.builder()
            .domains(Arrays.asList("api.example.com", "www.example.com"))
            .keyPair(keyPair)
            .build();
        
        // Прохождение challenge (HTTP-01 или DNS-01)
        Challenge challenge = acmeClient.requestChallenge(request);
        completeChallenge(challenge);
        
        // Получение нового сертификата
        X509Certificate newCertificate = acmeClient.getCertificate(request);
        
        // Обновление keystore
        updateKeystore(newCertificate, keyPair.getPrivate());
        
        // Перезагрузка SSL контекста
        reloadSSLContext();
    }
    
    private void updateKeystore(X509Certificate certificate, PrivateKey privateKey) throws Exception {
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        keyStore.load(new FileInputStream("keystore.p12"), "password".toCharArray());
        
        // Обновление сертификата и ключа
        keyStore.setKeyEntry("tomcat", privateKey, "password".toCharArray(), 
                           new Certificate[]{certificate});
        
        // Сохранение обновленного keystore
        keyStore.store(new FileOutputStream("keystore.p12"), "password".toCharArray());
    }
}

@Configuration
public class TLSSecurityConfig {
    
    @Bean
    public TomcatServletWebServerFactory tomcatFactory() {
        TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
        
        factory.addConnectorCustomizers(connector -> {
            connector.setSecure(true);
            connector.setScheme("https");
            
            // Настройка поддерживаемых протоколов
            connector.setProperty("sslProtocol", "TLS");
            connector.setProperty("sslEnabledProtocols", "TLSv1.2,TLSv1.3");
            
            // Безопасные cipher suites
            connector.setProperty("ciphers", 
                "TLS_AES_256_GCM_SHA384," +
                "TLS_AES_128_GCM_SHA256," +
                "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384," +
                "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256");
            
            // Принудительное использование серверных cipher suites
            connector.setProperty("useServerCipherSuitesOrder", "true");
            
            // Отключение небезопасных алгоритмов
            connector.setProperty("sslDisabledProtocols", "SSLv2,SSLv3,TLSv1,TLSv1.1");
        });
        
        return factory;
    }
    
    // Проверка безопасности TLS конфигурации
    public void validateTLSConfiguration() {
        String[] enabledProtocols = {"TLSv1.2", "TLSv1.3"};
        String[] secureCiphers = {
            "TLS_AES_256_GCM_SHA384",
            "TLS_AES_128_GCM_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
        };
        
        // Проверка на использование устаревших протоколов
        for (String protocol : enabledProtocols) {
            if (protocol.startsWith("SSL") || protocol.equals("TLSv1") || protocol.equals("TLSv1.1")) {
                throw new SecurityException("Insecure protocol detected: " + protocol);
            }
        }
    }
}

@Component
public class SSLMonitoringService {
    
    private final MeterRegistry meterRegistry;
    private final Logger logger = LoggerFactory.getLogger(SSLMonitoringService.class);
    
    public SSLMonitoringService(MeterRegistry meterRegistry) {
        this.meterRegistry = meterRegistry;
    }
    
    @EventListener
    public void handleSSLHandshakeCompleted(SSLHandshakeEvent event) {
        // Метрики TLS handshake
        Timer.Sample sample = Timer.start(meterRegistry);
        sample.stop(Timer.builder("ssl.handshake.duration")
                .tag("protocol", event.getProtocol())
                .tag("cipher", event.getCipherSuite())
                .register(meterRegistry));
        
        // Логирование деталей соединения
        logger.info("SSL handshake completed: protocol={}, cipher={}, client={}", 
                   event.getProtocol(), event.getCipherSuite(), event.getClientAddress());
        
        // Проверка на слабые cipher suites
        if (isWeakCipher(event.getCipherSuite())) {
            logger.warn("Weak cipher suite used: {}", event.getCipherSuite());
            meterRegistry.counter("ssl.weak_cipher").increment();
        }
    }
    
    @Scheduled(fixedRate = 3600000) // Каждый час
    public void monitorCertificateExpiration() {
        try {
            X509Certificate certificate = getCurrentCertificate();
            long daysUntilExpiration = getDaysUntilExpiration(certificate);
            
            // Метрика времени до истечения сертификата
            meterRegistry.gauge("ssl.certificate.days_until_expiration", daysUntilExpiration);
            
            if (daysUntilExpiration < 7) {
                logger.error("Certificate expires in {} days!", daysUntilExpiration);
                sendAlertToOpsTeam(certificate, daysUntilExpiration);
            } else if (daysUntilExpiration < 30) {
                logger.warn("Certificate expires in {} days", daysUntilExpiration);
            }
        } catch (Exception e) {
            logger.error("Failed to check certificate expiration", e);
            meterRegistry.counter("ssl.certificate.check_failed").increment();
        }
    }
    
    public void validateSSLConfiguration() {
        try {
            SSLContext sslContext = SSLContext.getDefault();
            SSLEngine engine = sslContext.createSSLEngine();
            
            // Проверка поддерживаемых протоколов
            String[] supportedProtocols = engine.getSupportedProtocols();
            String[] enabledProtocols = engine.getEnabledProtocols();
            
            for (String protocol : enabledProtocols) {
                if (isInsecureProtocol(protocol)) {
                    logger.error("Insecure protocol enabled: {}", protocol);
                    meterRegistry.counter("ssl.insecure_protocol", "protocol", protocol).increment();
                }
            }
            
            // Проверка cipher suites
            String[] enabledCiphers = engine.getEnabledCipherSuites();
            for (String cipher : enabledCiphers) {
                if (isWeakCipher(cipher)) {
                    logger.warn("Weak cipher suite enabled: {}", cipher);
                }
            }
            
        } catch (Exception e) {
            logger.error("SSL configuration validation failed", e);
        }
    }
}

[Frontend UI] → [API Gateway] → [Auth Service] → [Backend Services]
                     ↓
              [Keycloak/OAuth2 Server]

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Set-Cookie: accessToken=...; HttpOnly; Secure; SameSite=Strict;
Set-Cookie: refreshToken=...; HttpOnly; Secure; SameSite=Strict;

@GetMapping("/orders")
@PreAuthorize("hasRole('USER')")
public List<Order> getOrders() {
    return orderService.getUserOrders();
}

// Axios interceptor в React
axios.interceptors.response.use(
  response => response,
  async error => {
    if (error.response?.status === 401) {
      await refreshToken();
      return axios.request(error.config);
    }
  }
);

@Service
public class ServiceTokenService {
    
    @Value("${service.token}")
    private String serviceToken;
    
    public String getServiceToken() {
        return "Bearer " + serviceToken;
    }
}

// В RestTemplate или WebClient
.header("Authorization", serviceTokenService.getServiceToken())

POST /auth/login
Content-Type: application/json

{
  "username": "john.doe@example.com",
  "password": "SecurePass123!"
}

Response:
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600
}

GET /api/users/profile
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Content-Type: application/json

POST /auth/refresh
Content-Type: application/json

{
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Response:
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Header.Payload.Signature

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "user123",
  "name": "John Doe",
  "email": "john.doe@example.com",
  "roles": ["USER", "ADMIN"],
  "permissions": ["read:profile", "write:profile"],
  "iat": 1642680000,
  "exp": 1642683600,
  "iss": "https://auth.example.com",
  "aud": "api.example.com"
}

HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secret
)

1. Client → Authorization Server: запрос авторизации
2. User → Authorization Server: аутентификация
3. Authorization Server → Client: authorization code
4. Client → Authorization Server: обмен code на access token
5. Client → Resource Server: запрос с access token

1. Client → Authorization Server: client_id + client_secret
2. Authorization Server → Client: access token
3. Client → Resource Server: запрос с access token

1. Client → Authorization Server: запрос авторизации
2. Authorization Server → Client: access token напрямую

1. Client → Authorization Server: username + password
2. Authorization Server → Client: access token

// Автоматическое обновление токена
async function refreshAccessToken() {
  const refreshToken = getRefreshTokenFromStorage();
  
  const response = await fetch('/auth/refresh', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      refresh_token: refreshToken
    })
  });
  
  const data = await response.json();
  saveAccessToken(data.access_token);
}

// Axios interceptor
axios.interceptors.response.use(
  response => response,
  async error => {
    if (error.response?.status === 401) {
      try {
        await refreshAccessToken();
        return axios.request(error.config);
      } catch (refreshError) {
        // Redirect to login
        window.location.href = '/login';
      }
    }
    return Promise.reject(error);
  }
);

@RestController
@RequestMapping("/api/users")
public class UserController {
    
    @GetMapping("/profile")
    @PreAuthorize("hasRole('USER')")
    public UserProfile getProfile() {
        return userService.getCurrentUserProfile();
    }
    
    @GetMapping("/admin")
    @PreAuthorize("hasRole('ADMIN')")
    public List<User> getAllUsers() {
        return userService.getAllUsers();
    }
    
    @PostMapping("/create")
    @PreAuthorize("hasRole('ADMIN') or hasRole('MANAGER')")
    public User createUser(@RequestBody User user) {
        return userService.createUser(user);
    }
    
    @DeleteMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') and hasPermission(#id, 'User', 'DELETE')")
    public void deleteUser(@PathVariable Long id) {
        userService.deleteUser(id);
    }
}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/auth/**").permitAll()
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/api/user/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .jwtDecoder(jwtDecoder())
                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                )
            )
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            );
        
        return http.build();
    }
    
    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(jwt -> {
            List<String> roles = jwt.getClaimAsStringList("roles");
            return roles.stream()
                .map(role -> new SimpleGrantedAuthority("ROLE_" + role))
                .collect(Collectors.toList());
        });
        return converter;
    }
}

[Frontend] → [API Gateway] → [Keycloak] → [Backend Services]
                                ↓
                          [User Database]
                          [LDAP/AD]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:

      - name: keycloak
        image: quay.io/keycloak/keycloak:latest
        env:

        - name: KEYCLOAK_ADMIN
          value: "admin"
        - name: KEYCLOAK_ADMIN_PASSWORD
          value: "admin123"
        - name: KC_DB
          value: "postgres"
        - name: KC_DB_URL
          value: "jdbc:postgresql://postgres:5432/keycloak"
        ports:

        - containerPort: 8080
        command:

        - /opt/keycloak/bin/kc.sh
        - start-dev

@Configuration
public class KeycloakConfig {
    
    @Bean
    public JwtDecoder jwtDecoder() {
        return NimbusJwtDecoder.withJwkSetUri("http://keycloak:8080/realms/my-realm/protocol/openid-connect/certs")
                .build();
    }
    
    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(jwt -> {
            Map<String, Object> realmAccess = jwt.getClaimAsMap("realm_access");
            List<String> roles = (List<String>) realmAccess.get("roles");
            
            return roles.stream()
                .map(role -> new SimpleGrantedAuthority("ROLE_" + role.toUpperCase()))
                .collect(Collectors.toList());
        });
        return converter;
    }
}

{
  "realm": "my-app",
  "enabled": true,
  "sslRequired": "external",
  "registrationAllowed": false,
  "clients": [
    {
      "clientId": "my-frontend",
      "enabled": true,
      "publicClient": true,
      "redirectUris": ["http://localhost:3000/*"],
      "webOrigins": ["http://localhost:3000"]
    },
    {
      "clientId": "my-backend",
      "enabled": true,
      "serviceAccountsEnabled": true,
      "secret": "secret-key"
    }
  ],
  "roles": {
    "realm": [
      {"name": "USER"},
      {"name": "ADMIN"},
      {"name": "MANAGER"}
    ]
  }
}