عرض عملي: إعداد Keycloak وتدفق رمز التفويض + PKCE

خطوة بخطوة

1. Start Keycloak locally with Docker; verify image and version before recording.
2. Create a realm shop, a client with PKCE enabled, realm roles customer and admin, and two users.
3. In Postman, use the OAuth 2.0 authorization code with PKCE option and log in.
4. Decode the access token and find iss, aud, and the roles.
5. Planned mistake: a wrong redirect URI in the client setup gives an "invalid redirect" error. Fix: register the exact URI.
6. Compare the access token with the ID token.