What is Keycloak?
Keycloak is an open-source IAM server maintained by Red Hat. It runs as a standalone server (the Quarkus distribution) and your applications integrate with it over standard protocols. Your apps never see passwords — they send users to Keycloak and receive signed tokens back.
Core capabilities
Section titled “Core capabilities”Single Sign-On (SSO)
Section titled “Single Sign-On (SSO)”Once a user authenticates with Keycloak, any other application in the same realm can receive a valid token without asking the user to log in again. The session lives in Keycloak, not in your apps.
Standard protocols
Section titled “Standard protocols”Keycloak speaks OpenID Connect (OIDC) and OAuth2 as its primary protocols. It also supports SAML 2.0 for legacy enterprise integrations. Any compliant application — regardless of language or framework — can integrate without custom auth code.
User management
Section titled “User management”The admin console and REST API let you create, update, disable, and search users. Users can reset passwords, verify their email, configure TOTP, and manage sessions — all through Keycloak, not your app.
Identity brokering and social login
Section titled “Identity brokering and social login”Keycloak can delegate authentication to external identity providers — Google, GitHub, Microsoft, Facebook, or any OIDC/SAML-compatible IdP. Users click “Sign in with Google” on YOUR realm’s login page; Keycloak handles the federation.
User federation
Section titled “User federation”If your organisation already has users in LDAP or Active Directory, Keycloak can connect directly. Users authenticate against their existing directory; Keycloak synchronises attributes and manages sessions.
Admin console and REST API
Section titled “Admin console and REST API”Every operation available in the admin console is also available via the REST API. You can automate realm setup, client registration, and user creation using the API or the Keycloak Terraform provider.
Where Keycloak sits in your architecture
Section titled “Where Keycloak sits in your architecture”Keycloak sits between your users and your applications. Users authenticate once with Keycloak and receive signed tokens. Your apps validate those tokens locally — without calling Keycloak on every request.
flowchart TD U[Users] --> K[Keycloak auth server] K -- issues signed tokens --> A[Your apps]