Open-Source to the Rescue of My APIs: Securing Them with Gravitee.io and Keycloak
summary
How to secure existing APIs without changing backends by placing Gravitee.io as an API gateway/portal and Keycloak for authentication. The demo uses a Docker Compose stack to create an API with plans and subscriptions, fix CORS, enforce tokens (introspection vs local JWT validation), configure rate limits/quotas, and push analytics to Elasticsearch, showing blocked or allowed calls end-to-end.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:02API security challenges
- 2:32API management with Gravitee.io
- 4:15Gateway security role
- 6:00CORS issues and fixes
- 8:53Demo: CORS config in Gravitee.io
- 15:40User auth with Keycloak
- 19:20Keycloak realm and client setup
- 24:24Gravitee.io + Keycloak auth link
- 27:18ID vs auth in API Gateway
- 30:37Subscriptions and access plans
- 33:38OAuth2 token auth in Gravitee.io
- 38:09Final OAuth2 test
- 41:45Quotas and security best practices
- 43:31Advanced features Q&A
- 49:55Architecture summary
related talks
38mDesigning a composable API platform powered by open standards and open-source tools
54mProtecting API Workloads Against OWASP and Programming Language CVE's
44mAll your APIs are mine - Secure them now
18mSecure your Apps and APIs with strong authentication and Adaptive Access.
45mOpening Keynote – Tushar Kulkarni
20mBuilding a secure API: Overview of techniques and technologies needed to launch a secure API
18mMake Auth great again with Ory
51mAPI Security: Securing GraphQL without going around in circles