Keycloak: What Is It? Features, Key Terms and Use for SSO

What Is Keycloak?

Without central sign-in, every app has its own user management. Users need many passwords, and when someone leaves, IT has to lock each account one by one. Keycloak solves this. It handles sign-in for all connected apps in one place.

A picture: Keycloak is the front desk of an office building. You show your ID card there once and get a visitor pass. With this pass, you open every door you are allowed through, without showing your ID again each time.

The project started at Red Hat in 2014. Since 2023, it has been a project of the Cloud Native Computing Foundation (CNCF). Since version 17, Keycloak has run on the Java framework Quarkus. It is released under the Apache 2.0 license.

Key Features

• Single sign-on: sign in once, use all apps. Signing out also applies to all of them.
• Standard protocols: OpenID Connect, OAuth 2.0 and SAML 2.0.
• User federation: links to LDAP and Active Directory, and also Kerberos.
• Identity brokering: sign-in through other identity providers, such as a partner company's account or a social login.
• Multi-factor authentication: one-time codes via an app, hardware keys and passkeys via WebAuthn.
• Self-service: users change their password, profile and second factor themselves in the account console.
• Admin console: manage users, roles, apps and policies in one web interface.
• Extensible: you can add your own sign-in steps, themes and connections through interfaces.

Key Terms

Realm

A closed area with its own users, apps and settings. The "master" realm is only for managing Keycloak itself. For your users, you create your own realms, for example one per tenant.

Client

An app that uses Keycloak for sign-in, such as a wiki, a chat or your own web app.

Roles and Groups

Roles describe rights, such as "admin" or "reader". Groups bundle users, for example by department. It is best to assign roles to groups instead of single people.

Token

After sign-in, Keycloak gives the app a signed token. It states who the user is and which roles they have. The app checks the signature and then trusts the content.

How Sign-In with Keycloak Works

1. A user opens an app.
2. The app sends the user on to Keycloak.
3. Keycloak checks the password and, if needed, the second factor.
4. Keycloak sends the user back to the app with a token.
5. If the user opens another app, Keycloak sees the running session. No new sign-in is needed.

Running Keycloak Securely

• Keep it up to date: install updates quickly, because Keycloak is the gate to all your apps.
• Protect the admin console: do not expose it openly to the internet, and require MFA for admins.
• Password rules: set a minimum length and block known weak passwords.
• Brute force protection: turn on the built-in protection against many failed attempts.
• Encryption: allow access only over HTTPS and connect directories via LDAPS.
• Review logs: send sign-in events and changes to admins to a SIEM.

Keycloak and Alternatives

Besides Keycloak, there are other open source tools such as Authentik or Zitadel, and cloud services from large vendors. Points in favor of Keycloak are its large community, its many features and the option to run it in your own data center. Your user data stays under your control. In return, you need skills to set it up and run it.

Keycloak in SecTepe.Comm

Sign-in in SecTepe.Comm is based on Keycloak (on Quarkus), with PostgreSQL as its database. Each tenant gets its own realm. For MFA, one-time codes (TOTP), FIDO2 hardware keys and passkeys are available. Your Active Directory is connected via LDAPS, and accounts can be created on their own via SCIM 2.0. New passwords need at least 14 characters. Our article identity and access management with Keycloak and an AD connector shows how Keycloak works together with an AD connector.

Conclusion

Keycloak is a proven open source tool for single sign-on and identity and access management. It supports the common protocols, connects to Active Directory and offers MFA with passkeys. Because it is the gate to all your apps, it needs especially careful upkeep and protection.