Keycloak

Keycloak is an open-source identity and access management solution for modern applications and services.

It centralizes authentication, authorization, user management, and federation for applications.

Identity management is the process of managing users, credentials, identity attributes, roles, and access.

Authentication is the process of verifying who a user is.

Authorization decides what an authenticated user is allowed to do.

OAuth 2.0 is a delegated authorization framework that allows an app to access a resource on behalf of a user.

OIDC is an identity layer built on top of OAuth 2.0. It adds authentication and user identity information.

A realm is a logical space where users, clients, roles, and groups are managed.

They allow separation between environments, tenants, or application domains.

A user is an identity that can log in and receive tokens or access resources.

A client is an application or service that delegates authentication or authorization to Keycloak.

A client ID identifies the client application in Keycloak.

A client secret is a credential used by confidential clients to authenticate to Keycloak.

A public client runs on the frontend and does not have a secret, such as a SPA.

A confidential client can securely hold credentials such as a client secret, such as a backend server.

A role defines permissions or groups of permissions that can be assigned to users or clients.

A realm role applies within a realm.

A client role applies to a specific client application.

A user role is a role assigned to a particular user.

A group is a collection of users that can share common roles and attributes.

They simplify permission assignment across many users.

A federated identity refers to users or identities coming from an external identity provider or directory.

Identity brokering lets Keycloak delegate authentication to external providers like Google, GitHub, or LDAP.

SSO (Single Sign-On) allows the same login to work across multiple applications.

It reduces repeated logins and centralizes identity management.

An access token is a token presented to a resource server to authorize a request.

An ID token contains user identity claims as part of OIDC.

A refresh token allows a client to get a new access token without re-authenticating the user.

A token claim is a piece of data embedded in the token, such as sub, email, or role.

JWT (JSON Web Token) is a compact, self-contained token format used by OAuth/OIDC.

A signing key is used to sign tokens produced by Keycloak.

Token validation checks whether a token is valid, signed correctly, and still active.

A user session represents an authenticated user session in Keycloak.

Logout invalidates a user session and tokens, ending the authentication context.

The Keycloak admin console provides a UI for managing realms, users, roles, clients, and policies.

A Keycloak theme customizes the look and feel of login pages and admin pages.

To match the brand and user experience of your application.

An authentication flow is a sequence of steps that a user must complete to log in.

A browser flow is the sequence used for login in a browser-based app.

A direct grant flow is used for username/password authentication to obtain tokens directly.

Because it is less appropriate for browser apps and often better replaced by OIDC flows like Authorization Code + PKCE.

Authorization Code Flow is a browser-based OIDC flow where the client receives an auth code and exchanges it for tokens.

PKCE (Proof Key for Code Exchange) prevents authorization code interception and is recommended for public clients.

Implicit flow was an older OAuth flow for browser apps, but it is discouraged in modern security design.

Client Credentials Flow is used for machine-to-machine authentication where no user context is involved.

Password grant is an older OAuth flow for obtaining tokens using user credentials directly from the client.

It requires the client to handle user credentials and is less secure than more modern flows.

A resource server protects APIs and validates access tokens.

A protected API requires valid access tokens before serving requests.

A scope is a permission or claim group that a client may request from the user.

Permission is a granted right to access a resource or action.

A policy defines conditions under which a permission is granted.

Keycloak can enforce fine-grained permissions on resources and actions via UMA or policies.

UMA (User-Managed Access) allows users to manage access to resources and permissions.

A resource is something protected by authorization policies, like an API or feature.

An audience identifies the intended recipient of a token, usually the API or resource server.

`aud` tells the recipient which resource the token is for.

`iss` is the issuer of the token.

`sub` is the subject, usually the user identifier.

`exp` is the expiration time of the token.

To ensure authenticity and integrity of token data.

A public key is used by clients and resource servers to validate token signatures.

A private key is used by the identity provider to sign tokens.

A Keycloak adapter is a library that makes integrating applications with Keycloak easier.

It helps browser SPAs or frontend apps integrate with Keycloak using OIDC.

Usually an OIDC Authorization Code flow with PKCE for browser applications.

Usually a confidential client using client credentials or authorization code flow with a server-side session.

A custom identity provider is a custom external auth system integrated into Keycloak.

Federation allows Keycloak to connect to LDAP, Active Directory, or other identity stores.

A social login uses a third-party identity provider such as GitHub, Google, or Facebook.

A login page is the UI where users authenticate to Keycloak.

A registration page allows new users to create accounts.

A password policy defines minimum password length, complexity, or expiration requirements.

To reduce the risk of weak or reused credentials.

Account console is the user-facing UI where a user can manage their profile, sessions, and credentials.

A user attribute stores profile data like email, phone, or custom fields.

A mapper translates identity data from the external provider or source into Keycloak user attributes or token claims.

Because they map identity information from external sources into claims used by applications.

A consent screen asks the user to approve the application’s access to their identity and profile information.

User consent is the permission granted by the user to share identity data with a client application.

It defines who owns or manages access to a particular resource.

A session timeout is the period after which an inactive user session expires.

They reduce the risk of stale or forgotten sessions.

Brute-force detection detects repeated failed login attempts and may temporarily block access.

To reduce password guessing and unauthorized access attempts.

A login theme customizes the UI used for authentication screens.

To align with corporate branding or a product-specific experience.

It is a common way to run Keycloak in development or small deployments with Docker Compose.

It exports realm configuration to a JSON file for backup or migration.

Importing a realm restores the configuration into a new Keycloak instance.

The admin REST API lets automation manage realms, users, clients, and flows.

Because it enables automation and infrastructure-as-code for identity configuration.

A realm JSON file contains the realm definition and configuration.

Because it makes identity configuration reproducible and version-controlled.

It assigns a role to a user or group within a realm.

It assigns a role to a user or group within a specific client.

A claim is data inside a token that identifies or describes a user, such as email or groups.

A group claim includes group membership information in tokens.

Because applications can enforce authorization based on group membership.

A user profile is the set of attributes and metadata associated with a user.

The discovery document provides metadata about the OIDC provider, including issuer and token endpoints.

It is the standard `/.well-known/openid-configuration` endpoint.

It is the recommended flow for browser apps and public clients.

Because SPAs cannot securely keep a client secret and are exposed in the browser.

Token exchange is the process of exchanging one token for another token with different claims or audience.

ID token describes user identity. Access token authorizes access to APIs.

Refresh rotation ensures a token cannot be reused indefinitely and improves security.

Token revocation invalidates a token before its expiration time.

To quickly shut down a token if it is suspected to be compromised.

Logout ends the user session and often invalidates access and refresh tokens.

It manages the active user sessions, their validity, and timeouts.

It is the name Keycloak uses to reference an external provider.

It connects Keycloak to external identity providers such as Google or GitHub.

LDAP integration allows Keycloak to authenticate users against an enterprise directory.

Keycloak can integrate with Microsoft Active Directory or AD FS for enterprise identity.

An identity broker routes authentication requests to configured external identity providers.

It is a custom sequence of authentication actions for a realm or client.

It is the login flow used when a user logs in with an external identity provider for the first time.

A required action is an additional step a user must complete after login, such as password update or profile verification.

It prompts the user to change or confirm a password.

It defines the attributes and validation rules for user profiles.

User federation connects Keycloak to an external user store.

To avoid duplicating user identities in multiple systems.

It assigns a realm role to a user or group.

A client scope allows a client to request a set of claims or roles in an access token.

Because applications often need specific token claims or roles without polluting all tokens.

A protocol mapper transforms user data into a JWT claim or OIDC claim.

A built-in mapper, like `group-membership` or `email`, automatically adds common claims.

A custom mapper adds app-specific claims to tokens.

The user info endpoint returns user identity information to authorized clients.

It lets resource servers validate token validity and metadata.

It allows clients or systems to revoke tokens.

A JWK set contains public keys used to validate JWT signatures.

Because they need the public keys to verify JWT signatures.

TLS secures traffic between clients, Keycloak, and APIs.

Because identity data, tokens, and secrets must be protected in transit.

A secure cookie is used to store session-related info and should only be transmitted over HTTPS.

A SameSite cookie restricts when a browser sends cookies to third-party sites.

Because session hijacking or CSRF attacks may use cookies if not protected properly.

CSRF (Cross-Site Request Forgery) is a web attack where a malicious site tricks a browser into making authenticated requests.

It is the URL the user is redirected to after logout.

It is the callback URI used by OAuth/OIDC after login.

Because redirect URIs are a common OAuth security check and must match exactly or appropriately.

A trusted client is expected to handle security and identity correctly.

A public client cannot safely keep a secret and must use flows like PKCE.

Confidential clients can use server-side secure credential storage.

An authorization server issues tokens and manages identity and authorization decisions.

A resource owner is the person or system that owns the protected resource.

Delegated authorization means an app acts on behalf of a user with their consent.

Client configuration includes redirect URIs, grant types, scopes, and credentials.

It tells the API which client or resource should accept the token.

It happens when the API expects a different audience than the token provides.

Because otherwise an API might accept a token meant for another service.

It is the support for multiple isolated realms or clients in the same deployment.

Realm isolation keeps users, roles, and clients separate between realms.

It supports separate domains, tenants, or business units.

It maps external user attributes or groups into Keycloak identity information.

An event listener can react to login, logout, or registration events.

To trigger audits, metrics, or external notifications.

A theme provider allows custom pages or styling for authentication flows.

It is how a realm configuration is moved between environments or instances.

Because identity configs can drift over time without proper governance.

A default role is assigned to every user or group automatically.

To avoid repetitive role mapping for common access.

A composite role contains other roles and can simplify permissions.

They make role management easier and more scalable.

Keycloak includes some experimental features behind configuration flags.

It defines which claims and roles are included by default in tokens for clients.

It allows detailed permissions per resource, action, and user or policy.

It combines conditions and permissions to decide who can access a resource.

A permission ticket is part of UMA flows and represents a request for access to a resource.

It allows resource owners to manage and grant access to resources.

It ensures security controls and login settings are applied consistently within a realm.

Because it supports federation, roles, SSO, MFA, and policy enforcement across many apps.

It contains the user’s group memberships in a token.

Because resource servers can make decisions based on roles, scopes, or group claims.

It means the API is rejecting a token because it is not meant for that service.

Because they are security-sensitive and often grant access to protected actions.

The browser receives an authorization code and exchanges it for tokens in the backend.

Keycloak implements both OAuth 2.0 and OIDC and acts as an identity provider and authorization server.

MFA requires more than one factor, such as password and TOTP, to authenticate.

It reduces the chance of account compromise even if a password is stolen.

OTP (One-Time Password) is a transient code often generated via TOTP or HOTP.

TOTP (Time-based One-Time Password) is a common MFA method.

WebAuthn is a passkey or FIDO-based authentication mechanism that avoids static secrets.

It provides stronger user authentication and better phishing resistance.

A passkey is a passwordless or FIDO-based credential stored on a device.

A custom authenticator can implement special authentication logic or enforce custom user checks.

It enforces an action after login, such as password update, email verification, or profile completion.

SPI (Service Provider Interface) allows custom logic for identity or protocol features.

It enables integration with external systems when significant authentication or account events occur.

It allows custom UI and behavior at the Keycloak authentication boundary.

It enables custom user storage integration, including databases or external directories.

For integrating with legacy or non-standard identity systems.

It decides whether a request to a resource is allowed based on the user, resource, and rules.

It is the request object that a client creates when asking for a permission.

It is an event tracking administrative actions like user creation or client configuration changes.

It is a user-related event such as login, logout, or failed authentication.

Keycloak centralizes identity, strongly enforces protocols like OAuth/OIDC, and reduces per-application security complexity.

The real value of Keycloak is not just login pages; it is centralized identity, strong token handling, policy enforcement, and scalable user management across many applications.