Latest Articles - Page 10

Learn what single sign-on is and how SSO works in the browser: IdP vs application sessions, SAML and OIDC, trust between apps and the IdP, and why logout is not always universal.

Learn the difference between an identity provider (IdP) and a service provider (SP), how they work together in SSO, SP-initiated versus IdP-initiated login, and how SAML terms map to OIDC OpenID Provider and Relying …

Compare OAuth 2.0, OpenID Connect, and SAML 2.0 by purpose, tokens, flows, and when to choose each protocol, including how Keycloak supports OIDC and SAML clients.

Create and manage local Keycloak users—set and reset passwords, required actions, enable and disable accounts, search users, and automate with Admin REST API and kcadm on Keycloak 26.7.3.

Learn how to add custom user attributes in Keycloak with User Profile—create a department field, set values on users, show fields on registration forms, add validation and permissions, and map attributes into tokens.

Learn the difference between Keycloak start and start-dev, including HTTP, hostname, HTTPS, cache and database behavior, and when to use each mode.

Add custom claims to Keycloak access and ID tokens with protocol mappers. Map user attributes, groups, and audience on Keycloak 26.7.3, then verify with a decoded JWT.

Compare Keycloak realm roles, client roles, and composite roles—create employee and order-reader, inspect realm_access vs resource_access in access tokens, and troubleshoot roles missing from JWTs on Keycloak 26.7.3.

Learn the difference between public and confidential clients in Keycloak, which client type to use for SPAs, mobile apps and server-side applications, and how Client authentication, PKCE and client secrets fit together.

Configure Keycloak 26.7.3 with PostgreSQL using KC_DB and JDBC settings, start production mode against an external database, and prove realm data survives Keycloak container replacement on Podman or Docker.

Learn how to build an optimized Keycloak container image with kc.sh build, separate build-time and runtime configuration, and start it with start --optimized.

Run Keycloak behind Nginx or HAProxy with edge, re-encrypt, or passthrough TLS, set KC_PROXY_HEADERS and trusted addresses, enable PROXY protocol when needed, and fix 403, wrong scheme, and wrong OIDC issuer issues on …

Enable Keycloak HTTPS on port 8443 with PEM or PKCS12 certificates, set KC_HOSTNAME to the full public URL, reload certificates without restart, tune TLS protocols, and verify the OIDC issuer on Keycloak 26.7.3.

Learn how Keycloak groups work, create nested groups, add users, assign realm and client roles, and understand role and attribute inheritance.

Learn how Keycloak KC_* environment variables work, how to set them in Docker, Podman, Compose, and Linux, and how to fix values that appear ignored.

Learn how to automatically assign Keycloak default roles and default groups to new users, verify inheritance in the Admin Console, and understand what happens to existing accounts on Keycloak 26.7.3.

Learn which Keycloak Docker and Podman volumes to persist: mount /opt/keycloak/data for start-dev H2 data, persist the database for external PostgreSQL, and understand restart vs container recreate.

Learn how Keycloak loads keycloak.conf, where the file lives, how CLI flags and KC_* environment variables interact, configuration precedence, ${…} interpolation, build-time vs runtime options, and how to verify settings …

Run Keycloak 26.7.3 as a Linux systemd service after a ZIP install: dedicated keycloak user, minimal keycloak.conf, unit file directives, enable at boot, journalctl logs, and common startup failures.

Install Keycloak 26.7.3 with rootless Podman on RHEL-family Linux, start-dev on port 8080, Podman volumes and SELinux :Z mounts, container logs, and Quadlet persistence paths.

Install Keycloak on Linux using the official distribution, with Java runtime setup for Ubuntu, Debian, RHEL, Rocky Linux and AlmaLinux, first admin login, and start-dev verification.

Install Keycloak 26.7.3 on an existing Kubernetes cluster with the Keycloak Operator, PostgreSQL, database Secrets, a Keycloak custom resource, bootstrap admin login, and kubectl port-forward to the Admin Console.

Compare Keycloak Helm chart options with the official Operator, then install Keycloak 26.7.3 with the codecentric keycloakx chart, PostgreSQL, bootstrap admin credentials, helm upgrade, and uninstall on Kubernetes.

Run Keycloak 26.7.3 with PostgreSQL using Docker Compose on Linux — compose.yaml, KC_BOOTSTRAP_ADMIN variables, health checks, persistent volumes, Admin Console login, and PostgreSQL verification.

Install Docker Engine Community (Docker CE) on RHEL 8, 9, and 10 from the official DNF repository, enable docker.service, verify with hello-world, optionally add the docker group, upgrade, and uninstall cleanly.

Install Keycloak 26.7.3 with Docker Engine using the official Quay image, start-dev, bootstrap admin, port 8080, Docker logs, configuration delivery, first login, and container restarts.

Learn what a Keycloak client is, how realm clients differ from users, OIDC vs SAML client types, client ID vs internal UUID, redirect URIs, web origins, authentication settings, and common client errors on Keycloak …

Learn how Keycloak client scopes work — Default, Optional, and Dedicated scopes, creating and assigning scopes, and verifying JWT claims with before-and-after token examples.

Learn how authentication and authorization differ, with examples from login, API bearer tokens, roles, OAuth, OpenID Connect, and HTTP 401 versus 403 responses.

Learn what identity and access management (IAM) is, how authentication and authorization differ, and how SSO, MFA, provisioning, federation and access lifecycle management work together.