Auth
Keycloak
An open source identity and access management solution with SSO, OIDC, SAML and roles.
What it is
Keycloak is an identity server you host yourself. It manages users, roles, groups and sessions, and apps delegate sign-in to it through OIDC, OAuth 2.0 or SAML.
It supports social login, federation with LDAP and Active Directory, multi-factor auth, passkeys and custom themes. The structure: realms (isolated spaces), clients (apps), users, roles.
Red Hat started the project, and in 2023 it was accepted into CNCF as incubating. It gives full control over data but needs administration, upgrades and your own infrastructure.
Use it when
- You need SSO for many internal apps without per-user fees.
- Data must stay on your own infrastructure.
- Integration with corporate LDAP or Active Directory.
Avoid it when
- A small team with no time to operate a service: a managed Auth0 or Clerk fits better.
- A simple app with one sign-in method.
Key concepts
- Realm
- An isolated space of users, clients and settings.
- Client
- An app or API that trusts Keycloak.
- Roles / Groups
- Access rights at realm or client level and user grouping.
- Identity brokering
- Sign-in through external providers (Google, GitHub, another IdP).
Example
Interview questions
1. What is a realm in Keycloak?
An isolated container for users, roles, clients and settings. Realms cannot see each other's data, so it is handy for separating environments or customers.
2. How does an app integrate with Keycloak?
It registers as a client and uses OIDC Authorization Code with PKCE, then verifies signed tokens with keys from the JWKS.
3. How does Keycloak differ from Auth0?
Keycloak is open source and self-hosted, Auth0 is a managed paid service. The first gives control and a low per-user cost, the second saves operations time.
Interview questions from the bank
- A reporting service pulls data from your API hourly without a user. Which OAuth2 flow do you use?MiddleWeb security
- A user pressed 'Log out' in an app that signs in through Keycloak. What should happen on the client, in the backend and in the provider?MiddleWeb security
- An API accepts tokens from a shared realm, and a pentest got into the API with an id token. Why is this a problem and how do you fix it?MiddleWeb security
Related technologies
- OAuth 2.0A delegated authorization standard: an app gets limited access to a user's resources without their password.
- OpenID ConnectAn authentication layer on top of OAuth 2.0: the client receives an ID token with user information.
- Auth0A managed authentication and authorization service: sign-in, SSO, MFA and API access with no identity server of your own.
- JWTA compact signed token in JSON format that carries claims about a user or permissions.
- KubernetesKubernetes is a container orchestration system that deploys, scales and heals applications across a cluster of servers.
- Spring BootAn opinionated layer over Spring for Java and Kotlin with auto-configuration and one-command startup.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).