Awesome Keycloak

Carefully curated list of awesome Keycloak resources.

A curated list of resources for learning about the Open Source Identity and Access Management solution Keycloak. Contains books, websites, blog posts, links to github Repositories.

Contributing

Contributions welcome. Add links through pull requests or create an issue to start a discussion. Please refer to the contributing guide for details.

Contents

• Awesome Keycloak
• Contributing
• Contents
• General
  • Documentation
  • Discussion Groups and Mailing Lists
  • Books
  • Articles
  • Talks
  • Presentations
  • Video Playlists
  • Clients
  • Community Extensions
  • Integrations
  • Quick demo Videos
  • Themes
  • Docker
  • Kubernetes
  • Tools
  • Deployment Examples
  • Example Projects
  • Benchmarks
  • Help
  • Commercial Offerings
  • Miscellaneous
• License

General

Documentation

• Keycloak Website
• Current Documentation
• Archived Documentation
• Product Documentation for Red Hat Single Sign-On

Community, SIGs, Discussion Forums and Mailing Lists

• Keycloak Users Google Group
• Keycloak Developers Google Group
• Keycloak Discourse Group
• Inactive - Keycloak Developer Chat
• Inactive - User Mailing List
• Inactive - Developer Mailing List
• Mailing List Search
• Keycloak Subreddit
• GitHub Discussions
• CNCF Slack, #keycloak, #keycloak-dev
• Keycloak OAuth SIG
• Keycloak SRE SIG

Books

• Keycloak - Identity and Access Management for Modern Applications
• Keycloak - Identity and Access Management for Modern Applications - Second Edition

Articles

• How to get Keycloak working with Docker
• Single-Sign-On for Microservices and/or Java EE applications with Keycloak SSO
• Keycloak Admin Client(s) - multiple ways to manage your SSO system
• How to get the AccessToken of Keycloak in Spring Boot and/or Java EE
• JWT authentication with Vert.x, Keycloak and Angular 2
• Authenticating via Kerberos with Keycloak and Windows 2008 Active Directory
• Deploying Keycloak with Ansible
• Easily secure your Spring Boot applications with Keycloak
• How Red Hat re-designed its Single Sign On (SSO) architecture, and why
• OAuth2, JWT, Open-ID Connect and other confusing things
• X509 Authentication with Keycloak and JBoss Fuse
• Running Keycloak on OpenShift 3
• Introducing Keycloak for Identity and Access Management
• Keycloak Basic Configuration for Authentication and Authorisation
• Keycloak on OpenShift Origin
• Identity Management, One-Time-Passwords and Two-Factor-Auth with Spring Boot and Keycloak
• Keycloak Identity Brokering with Openshift
• OpenID Connect Identity Brokering with Red Hat Single Sign-On
• Authentication & user management is hard
• Securing Nginx with Keycloak
• Secure kibana dashboards using keycloak
• Configuring NGINX for OAuth/OpenID Connect SSO with Keycloak/Red Hat SSO
• Keycloak Clustering Setup and Configuration Examples
• MicroProfile JWT with Keycloak
• Keycloak Essentials
• SSO-session failover with Keycloak and AWS S3
• KTOR and Keycloak: authentication with OpenId
• Keycloak: Core concepts of open source identity and access management
• Writing Keycloak Extensions: Key Concepts and Anti-Patterns
• Who am I? Keycloak Impersonation API
• Setup Keycloak Server on Ubuntu 18.04
• Getting started with Keycloak
• Angular, OpenID Connect and Keycloak
• Angular, OAuth 2.0 Scopes and Keycloak
• Keycloak, Flowable and OpenLDAP
• How to exchange token from an external provider to a keycloak token
• How to Setup Role Based Access Control (RBAC) with Keycloak
• Building an Event Listener SPI (Plugin) for Keycloak
• Keycloak user migration – connect your legacy authentication system to Keycloak
• Keycloak Authentication and Authorization in GraphQL
• Kong / Konga / Keycloak: securing API through OIDC
• KeyCloak: Custom Login theme
• Keycloak: Use background color instead of background image in Custom Login theme
• How to turn off the Keycloak theme cache
• How to add a custom field to the Keycloak registration page
• How to setup Sign in with Google using Keycloak
• How to sign in users on Keycloak using Github
• Extending Keycloak SSO Capabilities with IBM Security Verify
• AWS SAML based User Federation using Keycloak
• AWS user account OpenID federation using Keycloak
• How to Run Keycloak in HA on Kubernetes
• How to create a Keycloak authenticator as a microservice?
• keycloak.ch | Installing & Running Keycloak
• keycloak.ch | Configuring Token Exchange using the CLI
• keycloak.ch | Configuring WebAuthn
• keycloak.ch | Configuring a SwissID integration
• Getting Started with Service Accounts in Keycloak
• Building cloud native apps: Identity and Access Management
• X.509 user certificate authentication with Red Hat’s single sign-on technology
• Grafana OAuth with Keycloak and how to validate a JWT token
• How to setup a Keycloak server with external MySQL database on AWS ECS Fargate in clustered mode
• Extending Keycloak: adding API key authentication
• Extending Keycloak: using a custom email sender
• Integrating Keycloak and OPA with Confluent
• UMA 2.0 : User Managed Access - how to use it with bash
• Setting Up A Keycloak Server For Authenticating To FileMaker
• How to Make Keycloak Start Up Faster When There Are a Lot of Offline Sessions
• Using Coder to Develop Keycloak Templates Live (almost)
• Keycloak Passkeys tutorial
• Keycloak as Authorization Server in .NET
• How to use Let's Encrypt certificates with Keycloak
• Keycloak Multi-Tenancy and the Pulumi Automation API: Part 1
• Instant User Management, SSO, and Secure Pages for ReactJS
• Securing a Next.js Application with Keycloak
• Django Web Authentication with Keycloak
• Keycloak Workshop for Step Up with MFA Biometrics Authentication (Passkeys) and Passwordless experience with Passkey autofill
• Migration from Spring Authorization Server to Keycloak Series' Articles
• Building Scalable Multi-Tenancy Authentication and Authorization using Open Standards and Open-Source Software
• Integrating LinkedIn with Keycloak
• Authenticating MCP OAuth Clients With SPIFFE and SPIRE
• Keycloak User Federation with LDAP and Active Directory

Talks

• JDD2015 - Keycloak Open Source Identity and Access Management Solution
• 2015 Using Tomcat and Keycloak in an iFrame
• 2016 You've Got Microservices Now Secure Them
• 2016 Keycloak: Open Source Single Sign On - Sebastian Rose - AOE conf (german)
• 2016 Sécuriser ses applications back et front facilement avec Keycloak (french)
• 2016 Keycloak and Red Hat Mobile Application Platform
• 2016 Easily secure your Front and back applications with KeyCloak
• 2017 Easily secure your Spring Boot applications with Keycloak - Part 1
• 2017 Easily secure your Spring Boot applications with Keycloak - Part 2
• 2018 How to secure your Spring Apps with Keycloak by Thomas Darimont @ Spring I/O 2018
• 2018 DevNation Live | A Deep Dive into Keycloak
• 2018 IDM Europe: WSO2 Identity Server vs. Keycloak (Dmitry Kann)
• 2018 JPrime|Building an effective identity and access management architecture with Keycloak (Sebastien Blanc)
• 2018 WJAX| Sichere Spring-Anwendungen mit Keycloak
• 2019 Spring I/O | Secure your Spring Apps with Keycloak
• 2019 DevoxxFR | Maitriser sa gestion de l'identité avec Keycloak (L. Benoit, T. Recloux, S. Blanc)
• 2019 DevConf | Fine - Grained Authorization with Keycloak SSO (Marek Posolda)
• 2019 VoxxedDays Minsk | Bilding an effective identity and access management architecture with Keycloak (Sebastien Blanc)
• 2019 Single-Sign-On Authentifizierung mit dem Keycloak Identity Provider | jambit CoffeeTalk
• 2020 Keycloak Team | Keycloak Pitch
• 2020 Keycloak Team | Keycloak Overview
• 2020 Please-open.it : oauth2 dans le monde des ops (french)
• 2022 Secure digital transformation via keycloak's FAPI - DevConf.cz Mini | June 2022
• Example how to configure Keycloak fine grained admin permissions
• 2025 FrosCon | Delegate authentication and a lot more to Keycloak with OpenID Connect, Alexander Schwartz
• Keycloak IGA (Keycloak fork)

Presentations

• Keycloak 101

Video Playlists

• Keycloak Identity and Access Management by Łukasz Budnik
• Keycloak by Niko Köbler
• Keycloak Playlist by hexaDefence
• Keycloak Tutorial Series by CodeLens
• KeycloakDevDay 2024 by dasniko

Clients

• Official Keycloak Node.js Admin Client ("Extremely Experimental")
• Keycloak Node.js TypeScript Admin Client by Canner
• Keycloak Go Client by Cloudtrust
• Keycloak Nest.js Admin Client by Relevant Fruit
• Keycloak Mock Library
• .NET / C# Keycloak.RestApiClient
• ACKC: Python API Client for Keycloak

Community Extensions

• Keycloak Extensions List
• Keycloak Benchmark Project
• Keycloak: Link IdP Login with User Provider
• Client Owner Manager: Control who can edit a client
• Keyloak Proxy written in Go
• Script based ProtocolMapper extension for SAML
• Realm export REST resource by Cloudtrust
• Keycloak JDBC Ping Setup by moremagic
• SMS 2 Factor Authentication for Keycloak via AWS SNS
• SMS 2 Factor Authentiation for Keycloak via SMS by Alliander
• Identity Provider for vk.com
• CAS Protocol Support
• WS-FED Support
• Keycloak Discord Support
• Keycloak Login with User Attribute
• zonaut/keycloak-extensions
• leroyguillaume/keycloak-bcrypt
• SPI Authenticator in Nodejs
• Have I Been Pwned? Keycloak Password Policy
• Keycloak Eventlistener for Google Cloud Pub Sub
• Enforcing Password policy based on attributes of User Groups
• Verify Email with Link or Code by hokumski
• Role-based Docker registry authentication
• SCIM for keycloak
• Keycloak Kafka Module
• Useful Keycloak EventListenerProvider implementations and utilities
• Keycloak: Home IdP Discovery extension
• Keycloak Metrics SPI
• Organizations for Keycloak by Phase Two
• Flexible IdP mapper for OIDC and SAML providers
• 2FA with Code sent via Email
• Admin Portal for User and Organization management by Phase Two
• MagicLink Authenticator by Phase Two
• Keycloak Metrics based on Micrometer
• softwarefactory-project/keycloak-filter-provider-users
• rciam/keycloak-group-management
• embesozzi/keycloak-webauthn-conditional-mediation WebAuthn Support for Passkeys
• Email Notifications when login from a new IP and Login History
• Keycloak Authenticator for Duo's Universal Prompt
• Keycloak extension for creating multi-tenant IAM for B2B SaaS applications
• OpenID Connect for Identity Assurance (OIDC4IDA) on Keycloak
• Keycloak Testcontainer for Node.js
• Keycloak GDPR Event Logger
• Keycloak Backup Email Required Action
• Keycloak Terms Authenticator: Require Terms and Conditions on every login
• Keycloak Adaptive Authentication Extension by @mabartos
• Keycloak GraphQL API by @blevine
• Keycloak SCIM Federation Support
• Keycloak Trusted Device Support by @wouterh-dev
• Keycloak MFA Plugins by @netzbegruenung
• Keycloak OpenFGA Event Publisher by @embesozzi
• JavaScript LDAP_ID ScriptMapper by @netzbegruenung
• evosec/keycloak-ipaddress-authenticator
• Identity provider for German eID L21s/keycloak-eid-identity-provider
• Identity provider for German eID governikus/keycloak-eid-identity-provider
• ALTCHA Captcha Extension for Keycloak
• Keycloak Webhooks from vymalo/keycloak-webhook
• Notification on Impersonation SebastEnn/impersonation-notification
• SPIFFE SVID Client Authenticator for Keycloak
• (Send) Email on user creation
• Keycloak Custom Modules for SRG hardening
• tidecloak (Keycloak fork)
• Keycloak reCAPTCHA Password Defense
• Keycloak Custom Attribute IDP Linking
• KETE - Event forwarding
• Keycloak Cookieless IDP Extension
• Pin Code Authenticator for Keycloak ACR/LOA
• Keycloak-GeoAware is an extension for Keycloak that integrates geolocation and device monitoring
• Keycloak Vault Provider for OpenBao and HashiCorp Vault
• Keycloak Redis Cache
• Cloudflare Turnstile support for Keycloak

Integrations

• Keycloak HTTP/MQTT/CoAP IoT Brokers Adapter
• Official Keycloak Node.js Connect Adapter
• Keycloak support for Aurelia
• Keycloak OAuth2 Auth for PHP
• Jenkins Keycloak Authentication Plugin
• Meteor Keycloak Accounts
• HapiJS Keycloak Auth
• zmartzone mod_auth_openidc for Apache 2.x
• Duo Security MFA Authentication for Keycloak
• Extension Keycloak facilitant l'utilisation de FranceConnect
• Ambassador Keycloak Support
• Keycloak Python Client
• Keycloak Terraform Provider
• Keycloak ADFS OpenID Connect
• React/NextJS Keycloak Bindings
• NextJS + tailwind + keycloak integration
• Keycloak Open-Shift integration
• Keycloak, Kong and Konga setup scripts (local development)
• SSO for Keycloak and Nextcloud with SAML
• Keycloak Connect GraphQL Adapter for Node.js
• python-keycloak
• Keycloak and PrivacyId3a docker-compose (local development)
• Nerzal/gocloak Golang Keycloak API Package
• Apple Social Identity Provider for Keycloak
• Micrometer Keycloak extension
• Keycloak Provider for Laravel's Socialite Plugin
• Vault Keycloak Plugin
• mantelo (Python Admin Client)
• Keyloak Integration for the German E-Health ID (GesundheitsID)
• Keycloak AuthServices .NET
• KETE - Event forwarding

Quick demo Videos

• Keycloak with istio envoy jwt-auth proxy

Themes

• Community Keycloak Ionic Theme
• A Keycloak theme based on the AdminLTE UI library
• GOV.UK Theme
• Carbon Design
• Modern
• Adminlte
• keycloakify: Create Keycloak themes using React
• Tailcloakify: Tailwind CSS Keycloakify Theme
• Keywind: Component-based theme built with Tailwind CSS
• TailwindUI theme
• Phase Two: Keycloak login theme template
• Phase Two: Extension for runtime loading of CSS themes
• Phase Two: 3 CSS-only Keycloak theme examples
• AUTHFIT: Keycloak login theme with a live, no-code editor built into the admin console.
• Online Keycloak Theme Editor for plain Keycloak Themes
• cloakey Online Theme Editor for Keycloakify based Themes
• Tailcloakify - A Keycloak theme based on Keycloakify and Tailwind

Docker

• Official Keycloak Docker Images
• Keycloak Examples as Docker Image
• Keycloak Maven SDK for managing the entire lifecycle of your extensions with Docker
• Keycloak with CRDB Support (CockroachDB)

Kubernetes

• Deprecated Keycloak Helm Chart
• codecentric Keycloak Helm Chart
• Import / Export Keycloak Config
• keycloak-operator
• Hostzero Keycloak Operator: Manage your Keycloak realm resources through Kubernetes CRs

Tools

• keycloakmigration: Manage your Keycloak configuration with code
• tool to autogenerate an OpenAPI Specification for Keycloak's Admin API
• oidc-bash-client
• louketo-proxy (FKA Gatekeeper)
• keycloak-config-cli: Configuration as Code for Keycloak
• Keycloak Pulumi
• Keycloak on AWS
• aws-cdk construct library that allows you to create KeyCloak on AWS in TypeScript or Python
• keycloak-scanner Python CLI
• Keycloak RestAPI Postman Collection
• Keycloak Configurator
• kcwarden Config Auditor

Deployment Examples

• Keycloak deployment with CDK on AWS with Fargate

Example Projects

• Examples from Keycloak Book: Keycloak - Identity and Access Management for Modern Applications
• Official Examples
• Keycloak Quickstarts
• Drupal 7.0 with Keycloak
• Securing Realm Resources With Custom Roles
• BeerCloak: a comprehensive KeyCloak extension example
• KeyCloak Extensions: Securing Realm Resources With Custom Roles
• Red Hat Single Sign-On Labs
• Spring Boot Keycloak Tutorial
• Custom Keycloak Docker Image of Computer Science House of RIT
• Example of custom password hash SPI for Keycloak
• Example for a custom http-client-provider with Proxy support
• Monitor your keycloak with prometheus
• Custom User Storage Provider .ear with jboss-cli setup
• Keycloak - Experimental extensions by Stian Thorgersen/Keycloak
• Securing Spring Boot Admin & Actuator Endpoints with Keycloak
• A Keycloak Mobile Implementation using Angular v4 and Ionic v3
• Example for Securing Apps with Keycloak on Kubernetes
• Example for Securing AspDotNet Core Apps with Keycloak
• Example for passing custom URL parameters to a Keycloak theme for dynamic branding
• Angular Webapp secured with Keycloak
• Keycloak Theme Development Kit
• Keycloak Clustering examples
• Keycloak Last Login Date Event Listener
• Keycloak Project Example (Customizations, Extensions, Configuration)
• Example of adding API Key authentication to Keycloak
• Example for using Keycloak Authorization with ASP.NET Core
• FAPI demo from DevConf.cz Mini: Secure digital transformation via keycloak's FAPI
• Keycloak enviornment with WebAuthn Support for Stepup Auth with MFA Biometrics and Passkeys (by embesozzi)
• How to: Keycloak - ASP.NET Core - Angular
• Verifiable Credential Authentication with OpenID Connect (VC-AuthN OIDC)
• FIDO2 with Keycloak for 1FA and 2FA christian-2/oidc-passkey
• A simple Django app to use Keycloak over OIDC by Amsterdam/keycloak_oidc
• Keycloak as a Verifiable Credential Issuer with OID4VCI by Adorsys
• Keycloak and SPIRE for Agent Identity

Benchmarks

• Gatling based Benchmark by @rvansa

Help

• Keycloak on Stackoverflow

Commercial Offerings

• Red Hat build of Keycloak
• Red Hat Single Sign-On
• INTEGSOFT UNIFIED USER CREDENTIALS WITH KEYCLOAK SSO
• JIRA SSO Plugin by codecentric
• Keycloak Competence Center by Inventage AG
• Cloud-IAM - Managed Keycloak SaaS with dedicated instances deployed in 20 minutes. ISO 27001:2022, SOC 2 Type 2, SecNumCloud 3.2 certified. 70+ regions, 99.98% SLA.
• Bare.Id - GDPR compliant Keycloak as a Service
• Phase Two (https://phasetwo.io/) offers hosting (free tier avaialable), on-prem deployments, and enterprise Keycloak support.
• Skycloak
• loginfactor
• univention
• Keymate
• Perfsys - Managed Keycloak deployment and SSO integration on AWS.

Miscellaneous

• Find sites using Keycloak with google
• Keycloak Dev Bookmarks - Use the tag keycloak
• Use fail2ban to block brute-force attacks to keycloak server
• Pentest-Report Keycloak 8.0 Audit & Pentest 11.2019 by Cure53
• Keycloak - CNCF Security SIG - Self Assesment

License

To the extent possible under law, Thomas Darimont has waived all copyright and related or neighboring rights to this work.