skills.rest
taipt1504
taipt1504COMMUNITY
Explore all skills by this author →
GitHub

summer-security

Integrate APISIX X-Userinfo decoding and Keycloak role synchronization with Spring Security.

3|2|Updated Jan 16, 2026
Search Tags:#authorization#reactive#keycloak#spring-security#apisix#role-synchronization#x-userinfo
One-click install
npx skills add https://github.com/taipt1504/agent-skills --skill summer-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: summer-security
Source: https://github.com/taipt1504/agent-skills/tree/main/skills/summer-security
Command: npx skills add https://github.com/taipt1504/agent-skills --skill summer-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill removes the complexity of wiring APISIX JWT forwarding, X-Userinfo decoding, and Keycloak-based role management into Summer Framework applications so endpoints can be protected by consistent, auditable resource-based roles.

Core Features & Use Cases

  • APISIX integration: Decodes Base64 X-Userinfo into Member objects and enforces stateless security via SecurityWebFilterChain customizers.
  • Role management & annotations: Standardizes role strings with @AuthRoles, ResourceDef and FeatureDef and enforces the seven-action convention for resources.
  • Reactive Keycloak client & sync: Provides ReactiveKeycloakClient for admin operations and KeycloakRoleSynchronizer to scan @AuthRoles and sync clients, roles, features, and custom attributes at startup.
  • Group-role authorization: Optional group-to-role resolution with L1/L2 caching, Redis invalidation channel, and configurable claim names for environments that require group-based access control.
  • Error mapping & safety: KeycloakException-to-error-code mapping and rules that prevent leaking secrets in configuration examples.

Quick Start

Use the summer-security skill to integrate APISIX X-Userinfo decoding, configure ReactiveKeycloakClient with your Keycloak server, and run role synchronization for your @AuthRoles-protected resources.

Frequently Asked Questions about summer-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I integrate APISIX X-Userinfo with Spring Security in reactive applications?▼

To integrate APISIX X-Userinfo, decode Base64 JWT headers into Member objects and enforce stateless security using SecurityWebFilterChain customizers within reactive Spring WebFlux services.

What is the best way to synchronize Keycloak roles with Spring Security annotations at startup?▼

Synchronize Keycloak roles by scanning @AuthRoles definitions at startup using KeycloakRoleSynchronizer to sync clients, roles, features, and custom attributes via ReactiveKeycloakClient.

Does this Summer Framework security integration support group-based access control?▼

Group-based access control is supported through optional group-to-role resolution featuring L1/L2 caching, Redis invalidation channels, and configurable claim names for environments needing group authorization.

Can I use KeycloakException mapping and prevent secret leaks in Spring Security configurations?▼

KeycloakException-to-error-code mapping is provided alongside rules that prevent leaking secrets in configuration examples to ensure error mapping and safety.

Why do I need a UserInfoAuthenticationConverter for reactive Spring WebFlux services?▼

A UserInfoAuthenticationConverter is needed to handle Mono-returning compatibility for JWT-to-Member decoding in reactive Spring WebFlux Summer services requiring stateless APISIX integration.

Related Skills

Explore More Software Engineering Skills→
abudhahirabudhahir

java-architect

Guide building, configuring, and debugging Spring Boot 3.x enterprise Java applications.

Community
Advanced
AndrewDonelsonAndrewDonelson

Strata

Manage multi-tier data with a unified Go API for Get, Set, Delete, and Search.

Community
Advanced
Prathmesh2000Prathmesh2000
1

caching-strategy

Design multi-layer caching strategies with TTLs and invalidation policies.

Community
Advanced
thehivegroup-aithehivegroup-ai

keycloak-bff-auth

Implement Keycloak BFF authentication with OIDC, JWT verification, and RBAC middleware.

Official
Advanced