Articles by Deepak Prasad
EC2 Instance Reachability Check Failed? How to Fix It
Why the EC2 instance reachability check fails while system status stays ok, how ARP-based instance status checks differ from SSH timeouts, how to read describe-instance-status and Get system log on Linux, and how to …
EC2 User Data Not Running? How to Fix It
Why EC2 user data may not run or may fail silently on Linux, how to confirm the script was stored, read cloud-init status and logs, fix shebang, PATH, and timing problems, and verify a corrected launch on RHEL 10.
EC2 Won't Boot After an /etc/fstab Change? How to Fix It
How to recognize an EC2 Linux boot failure from system log mount timeouts and emergency mode after a bad etc fstab edit, stop and snapshot the root volume, attach it to a rescue instance, compare UUIDs with lsblk and …
EC2 1/2 Status Checks Failed? System vs Instance Status Explained
Why EC2 shows 1/2 checks failed or 3/3 checks passed, what system vs instance status checks test, how attached EBS and application checks differ, how to read describe-instance-status and Get system log, and when reboot, …
Lost an EC2 PEM Key? Regain SSH Access
How to regain SSH access when the EC2 private key (.pem) is lost, why AWS cannot re-download the old key, and tested recovery paths through Systems Manager, AWSSupport-ResetAccess, and offline EBS root-volume repair on …
EC2 SSH Permission Denied (publickey)? How to Fix It
Why EC2 SSH returns permission denied publickey when the network path works but public-key authentication fails, how to confirm the correct EC2 username, verify the private key against authorized_keys, read ssh -vvv …
EC2 SSH Connection Refused? How to Fix It
Why EC2 SSH connection refused means the instance is reachable but nothing accepted TCP on port 22, how to confirm with nc and ssh -vvv, check sshd status, listen port and address, sshd_config, host keys, port conflicts, …
Fix growpart "No Space Left on Device" on AWS EC2
Why growpart returns No space left on device after an EBS resize on EC2, how to compare EBS, partition, and filesystem size, use the tmpfs or TMPDIR workaround, extend the partition, grow XFS or ext4, and verify the …
AWS Tutorial for Beginners - End-to-End Cloud Hands-On
Free hands-on AWS tutorial for beginners: the AWS CLI, EC2, S3, RDS, Lambda, CloudFormation, CDK, and CI/CD, with labs you run in your own AWS account.
Keycloak Step-Up Authentication
Configure Keycloak step-up authentication with LoA 1 password and LoA 2 OTP, map silver and gold ACR values, request acr_values from an OIDC client, step up from an existing SSO session, decode the acr claim, and handle …
Keycloak Recovery Codes
Learn how to enable Keycloak recovery codes, generate and store backup codes, use Try another way for 2FA recovery, and regenerate spent codes.
Keycloak Conditional Authentication Flows
Learn how Keycloak Conditional subflows evaluate built-in conditions, compare Conditional OTP Form with role-gated MFA subflows, combine Condition user role and user configured, test a four-state matrix, and debug …
Keycloak Required Actions
What Keycloak Required Actions are, how to assign them, when they run at login or by email, and how to troubleshoot pending UPDATE_PASSWORD, VERIFY_EMAIL, and CONFIGURE_TOTP on Keycloak 26.7.3.
Keycloak Passwordless Authentication
Learn how Keycloak passwordless authentication works with passkeys, WebAuthn, identity providers, and magic links, including enrollment, migration, and account recovery.
Keycloak TOTP Two-Factor Authentication
Enable Keycloak TOTP 2FA with realm OTP policy, Configure OTP required actions, authenticator app enrollment, browser login with OTP, selective enforcement patterns, lost-device credential reset, recovery-code handoff, …
Keycloak SMTP Configuration: Configure and Test Email
Configure Keycloak realm SMTP in the Admin Console, choose SSL or STARTTLS, test email delivery, authenticate with password or XOAUTH2, and fix common connection errors on Keycloak 26.7.3.
Keycloak Passkeys and WebAuthn Tutorial
Enable Keycloak 26.7.3 passkeys and WebAuthn passwordless login, register platform passkeys and security keys, configure RP ID and conditional UI, compare second-factor WebAuthn, and troubleshoot origin and missing …
Configure Forgot Password in Keycloak
Enable Keycloak forgot password with realm SMTP, test reset-credentials email links, compare safe responses for unknown usernames, fix missing buttons and mail failures, and handle expired action tokens on Keycloak …
Keycloak Password Policy
Configure Keycloak realm password policy for length, history, expiry, blacklist, and regex rules, separate user-facing checks from Argon2 or PBKDF2 hashing parameters, test when policies apply to existing users, and …
Keycloak Custom Authentication Flow: Require OTP by Role
Copy the Keycloak browser flow, add a Group MFA conditional subflow that requires OTP for users with realm role mfa-lab-required, bind browserFlow safely, test four login scenarios, and export realm configuration on …
Keycloak Authentication Flows Explained
Learn how Keycloak composes browser login from flows, subflows, and executions; how Required, Alternative, Conditional, and Disabled requirements evaluate; default Browser flow walkthrough, bindings, safe duplication, …
Keycloak Implicit Flow: Should You Still Use It?
What Keycloak Implicit Flow is, why response_type=token is discouraged for new SPAs, how it differs from Authorization Code with PKCE, and how to migrate and disable implicit flow on Keycloak 26.7.3.
Keycloak DPoP
Bind Keycloak access tokens to a client-held EC key with DPoP proof JWTs, request sender-constrained tokens on Keycloak 26.7.3, verify proofs at a resource API, and reproduce replay and key-mismatch failures.
Keycloak Direct Access Grants: Why ROPC Is Unsafe and What to Use Instead
What Keycloak Direct Access Grants means, why grant_type=password is discouraged, common token-endpoint errors, and safer replacements (PKCE, device flow, client credentials) on Keycloak 26.7.3.
Keycloak Pushed Authorization Requests (PAR)
Push OAuth authorization parameters to Keycloak with PAR, complete Authorization Code flow using request_uri on Keycloak 26.7.3, and enforce PAR per client with confidential client authentication.
Keycloak Standard Token Exchange
Configure Keycloak Standard Token Exchange v2 with subject_token, requester client scopes, audience filtering, claim comparison before and after exchange, and troubleshooting invalid_target and access_denied errors on …
Keycloak Logout and OIDC RP-Initiated Logout
Configure Keycloak RP-initiated logout with id_token_hint and post_logout_redirect_uri, compare front-channel and backchannel logout across two clients, and diagnose stale app sessions on Keycloak 26.7.3.
Keycloak JWKS and JWT Signature Verification
Discover Keycloak issuer and JWKS URI, verify RS256 access token signatures locally with kid lookup, validate iss aud and exp claims, reject ID tokens at APIs, and handle unknown kid after key rotation on Keycloak …
Keycloak Token Revocation
Revoke Keycloak access and refresh tokens with the RFC 7009 endpoint, compare introspection and local JWT checks after revocation, and choose between endpoint revoke, logout, session termination, and client secret …
Keycloak CIBA Authentication
Configure Keycloak Client Initiated Backchannel Authentication on a confidential client, run a minimal HTTP authentication channel, post a login_hint backchannel request, and poll with auth_req_id for access tokens on …