Tag: #keycloak
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 29 posts
29 posts are tagged #keycloak; the most recent was published on 2026-07-17.
Often tagged together: #security 23 #sso 19 #devops 18 #oidc 18 #oauth2 12
Most read in the last 90 days:
- Keycloak vs Authentik vs Zitadel vs Ory Hydra vs Auth0 vs WorkOS vs Okta — 2026 SSO / OIDC / SAML / OAuth 2.1 / FAPI 2.0 / FedCM Deep Dive
- OAuth Token Exchange (RFC 8693) — The Definitive Guide to Delegation and Propagation in Microservices
- Keycloak LDAP/Active Directory Integration — A Practical Guide to User Federation
Keycloak 26.7 — SCIM Promoted to Preview, Multi-Cluster v2 Without External Infinispan, and What to Watch in the Upgrade
Keycloak 26.7.0, released on July 9, 2026, promoted the SCIM API — a request that had been open for nearly four years — to preview, and shipped multi-cluster v2 in preview, which builds multi-cluster HA out of the databa
2026-07-17 · 16 min read #security#keycloak#sso#iam#scimBuilding SSO with Keycloak — From Realm, Client, and Flows to the 2026 New Features
Instead of bolting a separate login onto each of 20 internal apps, SSO lets a single identity server stand in for all of them. This post makes sense of Keycloak — the open-source standard — through four core concepts (Re
2026-07-09 · 9 min read #keycloak#sso#oidc#security#devopsFrom SiteMinder to Keycloak — A Legacy SSO Migration Strategy and Practical Roadmap
A practical roadmap for migrating a SiteMinder estate to Keycloak: application inventory classification, an object mapping table, SAML brokering coexistence architecture, oauth2-proxy header translation, gradual password
2026-06-12 · 16 min read #keycloak#siteminder#sso#iam#migrationThe Evolution of Authorization Models — RBAC, ABAC, ReBAC, and OpenFGA/Zanzibar
Once authentication is solved, the next battleground is authorization. We trace the evolution of authorization models from RBAC role explosion through ABAC policy complexity to the ReBAC paradigm introduced by Google Zan
2026-06-12 · 15 min read #authorization#rbac#rebac#openfga#zanzibarCustomizing Keycloak Tokens — Protocol Mappers and Claims Design in Practice
A hands-on guide to designing JWT claims with Keycloak Protocol Mappers and Client Scopes. Covers built-in mappers, a custom ProtocolMapper SPI implementation, audience validation pitfalls, token bloat diet strategies, a
2026-06-12 · 15 min read #keycloak#oidc#jwt#sso#securityKeycloak Observability — Metrics, Audit Logs, and Event-Driven Monitoring
A comprehensive guide to Keycloak observability: the event system and metrics endpoint, shipping events externally with the EventListener SPI, building Prometheus and Grafana dashboards, OpenTelemetry tracing, anomaly de
2026-06-12 · 13 min read #keycloak#observability#monitoring#prometheus#securityKeycloak 26 Architecture Deep Dive — Understanding Realms, Clients, and the Quarkus Runtime
A deep dive into the internal architecture of Keycloak 26.x. We cover the WildFly-to-Quarkus transition, the realm/client/role domain model, the authentication flow engine, kc.sh build optimization, and the new features
2026-06-12 · 16 min read #keycloak#sso#oidc#security#devopsFAPI 2.0 — A Complete Guide to the Financial-grade API Security Profile
A thorough walkthrough of FAPI 2.0 Security Profile, the standard of the open banking and open data era. Covers the simplification from FAPI 1.0 to 2.0, the core requirements of PAR, PKCE, and sender-constrained tokens,
2026-06-12 · 15 min read #fapi#oauth2#oidc#keycloak#securityZero Trust and Identity-Aware Proxy — Building the BeyondCorp Model Yourself
The perimeter is dead and identity-first security is the new default. This post walks through the core of the Google BeyondCorp papers and builds an Identity-Aware Proxy from scratch with oauth2-proxy and Keycloak. We co
2026-06-12 · 18 min read #zero-trust#iap#beyondcorp#oauth2-proxy#keycloakThe Hard Problem of Single Logout (SLO) — Designing Front-Channel and Back-Channel Logout
In SSO, logout is harder than login. This post covers the three-layer session model, how OIDC RP-Initiated/Front-Channel/Back-Channel Logout work and where they fail, the logout token JWT structure, the realistic failure
2026-06-12 · 17 min read #sso#oidc#saml#keycloak#logoutRefresh Token Rotation and Session Management — Designing a Theft-Resistant Token Lifecycle
From access/refresh token lifetime design principles to rotation, reuse detection, and token family invalidation — we design a token lifecycle that assumes theft. We cover the three-layer model of IdP, app, and SSO sessi
2026-06-12 · 16 min read #oauth2#session#keycloak#security#ssoPasskeys Enterprise Rollout Guide — From WebAuthn/FIDO2 to Keycloak Integration
In 2026, passwordless authentication is no longer an experiment but the emerging default. This post dissects the WebAuthn registration/authentication ceremonies and attestation, walks through Keycloak 26 passkeys configu
2026-06-12 · 17 min read #passkeys#webauthn#fido2#keycloak#securityDesigning the Coexistence of Legacy WebSSO and Modern IAM — Architecture Patterns for the Hybrid Transition Era
The transition from legacy WebSSO to modern IAM lasts for years. We organize four coexistence patterns — protocol bridges, reverse-proxy header injection, identity orchestration, and the strangler fig — along with sessio
2026-06-12 · 18 min read #iam#sso#keycloak#siteminder#architectureKeycloak SPI Extension Development — From Custom Authenticators to EventListeners
A complete guide to developing Keycloak SPI (Service Provider Interface) extensions. We cover the Provider/ProviderFactory architecture, a full internal SMS OTP Authenticator implementation, a Kafka audit-log EventListen
2026-06-12 · 13 min read #keycloak#spi#java#security#devopsKeycloak Identity Brokering — From Social Login to External IdP Federation
A practical guide to building Google/GitHub/Apple social login and external SAML/OIDC IdP federation with Keycloak Identity Brokering. Covers the first broker login flow, account linking with duplicate emails, attribute
2026-06-12 · 15 min read #keycloak#sso#oidc#saml#identity-brokeringOAuth Token Exchange (RFC 8693) — The Definitive Guide to Delegation and Propagation in Microservices
How to solve the token propagation problem between microservices with RFC 8693 Token Exchange. Covers the difference between impersonation and delegation, request and response parameters, standard support in Keycloak 26.
2026-06-12 · 15 min read #oauth2#keycloak#oidc#security#microservicesDesigning SSO for Multi-Tenant SaaS — An Architecture for Enterprise Customer Onboarding
In B2B SaaS, supporting SSO means federating with each customer IdP. This post designs multi-tenant SSO end to end: realm-per-tenant vs Keycloak Organizations, email-domain home realm discovery, domain verification, JIT
2026-06-12 · 16 min read #sso#saas#keycloak#oidc#samlKeycloak + Spring Security 6 Integration — Resource Server and OAuth2 Client in Practice
A practical guide to integrating Keycloak with Spring Security 6 as an OAuth2 Resource Server and Client. Covers issuer-uri auto-configuration, mapping realm and client roles with JwtAuthenticationConverter, OIDC logout,
2026-06-12 · 11 min read #keycloak#spring-security#oauth2#oidc#jwtKeycloak LDAP/Active Directory Integration — A Practical Guide to User Federation ♪ Listenable
A hands-on guide to integrating LDAP and Active Directory with Keycloak User Federation, from architecture to production settings. Covers edit modes and sync strategies, AD-specific configuration, attribute mappers, perf
2026-06-12 · 21 min read #keycloak#ldap#active-directory#sso#securityAdvanced OAuth Flows — When You Need CIBA, Device Flow, and DPoP
A guide to advanced OAuth mechanisms for authentication scenarios that the standard redirect flow cannot solve. Covers the Device Authorization Grant (RFC 8628), CIBA with its poll/ping/push modes, the DPoP (RFC 9449) pr
2026-06-12 · 15 min read #oauth2#oidc#keycloak#ciba#dpop