This article was written in January 2022 for Keycloak.X 16.1, before the official Keycloak Operator existed. It is kept as it was, for reference only: its image, options and manifests no longer apply to current Keycloak versions.

For an up-to-date deployment, read Keycloak on Kubernetes with operators, step by step: Keycloak Operator, PostgreSQL with CloudNativePG, and applications protected by Envoy Gateway.

Keycloak.x will become the reference soon.

According to the blog post, Keycloak 18 will not support Wildfly, after that no wildfly version… Now it is time to migrate !

We are still waiting for a Kubernetes operator with Keycloak.X, in this post we will see how to build your own cluster based on Keycloak.X 16.1.0

At please-open.it we use Keepass for passwords management. This simple and open source solution gives us entire satisfaction, only with a shared file on our internal cloud.

We tried to improve a lot the user experience by creating the simpliest passwords manager application.

UMA 2.0 is known as a delegation of authorizations standard. Keycloak is fully compatible with UMA 2.0.

With a bash tool developped by please-open.it, let’s see how to use UMA 2.0

This article explains what is UMA 2.0 with an example using our new bash tool : uma-bash-client.sh

Actions tokens are a particular type of token that allows unauthenticated users to perform some limited and predefined actions.

In this article we will see how to use them to create authenticated download links with a simple and short PHP script intended to run on shared web hosting.

There are several methods for authentication : certificates, passwords, pincode, webauthn, One Time Password…

Choosing an authentication method is not a technical choice : it has hudge impacts on security but also on User eXperience.

This article shows several demos, built with Keycloak, and let you have a perception of User eXperience for each authentication method.

Action tokens are a particular type of token that allows unauthenticated users to perform some limited and predefined actions.

Usual use case are :

• E-mail confirmation
• Credentials reset
• Execute required action(s)
• and any action relevant with the flow and your use cases…
• This article explains what is an action token and how to use it to authenticate users from a link inside a newsletter

OpenVPN allows usage of PAM modules. By using an oauth2 client PAM module and password grant, we can use our own SSO (Keycloak) to authenticate users on a VPN infrastructure.

For Oauth2 providers which do not allow Password Grant, we will use a “token authentication” by providing a valid token instead of a password. Code and demo with Google as authentication provider.