Free Online Course · Self-paced · Hands-on

Keycloak IAM Tutorial: Identity and Access Management Course

Free Keycloak tutorial and IAM course covering realms, clients, OIDC, LDAP federation, SAML, and operations, with Podman labs tested on Keycloak 26.7.

  • 25 chapters
  • 259 lessons
  • ~40h
  • Beginner to Intermediate
  • Tested with Keycloak 26.7.x
  • Updated Sep 2026
Start the course View syllabus
Keycloak IAM Tutorial: Identity and Access Management Course
By Last updated

About this course

This is a free, self-paced course that takes you from IAM vocabulary to running Keycloak as the identity provider for real applications. The syllabus follows the upstream documentation for the current 26.7 release: installation and production configuration first, then realms and clients, OAuth 2.0 and OpenID Connect, LDAP and Active Directory federation, identity brokering, SAML, SCIM, and day-two operations.

Every hands-on lesson runs on one RHEL host with rootless Podman and a pinned Keycloak image, so you can repeat the commands without a cloud account or an existing directory. The same container commands work with Docker on any Linux host. PostgreSQL, an LDAP server, and a reverse proxy join that host only when a lesson needs them, and the federation chapters reuse the directories built in the OpenLDAP and 389 Directory Server courses.

If OAuth, OIDC, or realms are new to you, start with IAM and Identity Fundamentals and finish the installation chapter before you touch federation. If you already run Keycloak, each lesson carries its own setup, so you can go straight to production configuration, realms and clients, or the reverse proxy chapter. Lessons that are still being written show as Coming soon in the syllabus.

What you'll learn

  • Explain IAM, SSO, and where OAuth 2.0, OpenID Connect, SAML, LDAP, and SCIM each fit
  • Install Keycloak from the ZIP, with Podman, Docker Compose, the Kubernetes Operator, or Helm, then move from start-dev to production mode with PostgreSQL and HTTPS
  • Model realms, users, groups, realm and client roles, clients, client scopes, and protocol mappers for multi-application SSO
  • Configure OAuth 2.0 and OpenID Connect flows, including authorization code with PKCE, client credentials, token validation, and logout
  • Harden sign-in with authentication flows, password policy, TOTP, passkeys, and brute-force detection
  • Federate users and groups from OpenLDAP, 389 Directory Server, and Active Directory, and troubleshoot sync and bind failures
  • Broker external identity providers, connect SAML service providers, and provision users with SCIM
  • Run Keycloak behind a reverse proxy, then monitor, back up, upgrade, and scale it for production

Who this course is for

  • Linux administrators who want single sign-on for internal applications without handing identity to a SaaS provider
  • Identity engineers connecting LDAP or Active Directory users to OIDC and SAML applications
  • DevOps and platform engineers running Keycloak in containers or on Kubernetes, with PostgreSQL behind a reverse proxy
  • Application developers who register clients, request tokens, and need to know where each claim comes from

Prerequisites

  • Comfortable Linux command line: systemd, editing config files, ports, DNS, and basic TLS
  • One Linux VM with Podman or Docker, 2 vCPU, 8 GiB RAM, and 40 GiB disk (4 vCPU and 16 GiB once PostgreSQL and an LDAP server share the host)
  • No paid account for the core labs, since Keycloak, PostgreSQL, and OpenLDAP or 389 Directory Server all run on that one host. The Active Directory, Entra ID, Okta, and AWS chapters need access to those services
  • No IAM background needed, because the fundamentals chapter explains OAuth, OIDC, SAML, and realm vocabulary before any setup

Versions and testing environment

Every command in this course was run on this stack

ComponentVersionNotes
Keycloak 26.7.x Official quay.io/keycloak/keycloak image with a pinned tag, plus the ZIP distribution for the Linux and systemd lessons
Red Hat Enterprise Linux 10.2 Lab host OS. Container commands are the same with Podman or Docker on any Linux host
Podman 5.8.x Primary runtime, rootless. Docker Engine 29.x with Compose v5 is used in the Docker lessons
PostgreSQL 16 Production-mode persistence. The embedded H2 database is only used with start-dev
OpenJDK 21 Needed for the ZIP install only. The container image ships its own JDK

Syllabus

25 chapters · 259 lessons · ~40h of reading

  1. 1 IAM and Identity Fundamentals 11 lessons · ~2h 22m
    1. Part 1 What Is Keycloak and How Does It Work? 12 min read
    2. Part 2 IAM Explained: Identity, Authentication and Authorization 13 min read
    3. Part 3 Authentication vs Authorization 10 min read
    4. Part 4 Identity Provider (IdP) vs Service Provider (SP) 11 min read
    5. Part 5 What Is Single Sign-On (SSO) and How Does It Work? 13 min read
    6. Part 6 OAuth 2.0 vs OpenID Connect vs SAML 15 min read
    7. Part 7 LDAP vs SAML vs OIDC vs SCIM 16 min read
    8. Part 8 Keycloak User Federation vs Identity Brokering: LDAP/AD vs External IdP 17 min read
    9. Part 9 Keycloak SCIM vs LDAP: Federation vs Provisioning 10 min read
    10. Part 10 JWT Access Token vs ID Token vs Refresh Token 13 min read
    11. Part 11 Keycloak vs Red Hat Build of Keycloak 12 min read
  2. 2 Installation and Baseline Keycloak Environment 17 lessons · ~3h 24m
    1. Part 12 Install Keycloak on Linux (ZIP) 12 min read
    2. Part 13 Install Keycloak with Docker 12 min read
    3. Part 14 Install Keycloak on Kubernetes (Operator) 18 min read
    4. Part 15 Run Keycloak as a systemd service 14 min read
    5. Part 16 Install and Run Keycloak with Podman 15 min read
    6. Part 17 Keycloak Docker Compose with PostgreSQL 15 min read
    7. Part 18 Install Keycloak on OpenShift Coming soon
    8. Part 19 Install Keycloak with Helm 19 min read
    9. Part 20 Keycloak Development Mode vs Production Mode 10 min read
    10. Part 21 Configure Keycloak with PostgreSQL 13 min read
    11. Part 22 Keycloak `keycloak.conf` Configuration Guide 13 min read
    12. Part 23 Keycloak Environment Variables (`KC_*`) 17 min read
    13. Part 24 Configure Keycloak HTTPS/TLS with SSL Certificates 9 min read
    14. Part 25 Keycloak Bootstrap Admin User 8 min read
    15. Part 26 Build an Optimized Keycloak Container Image 11 min read
    16. Part 27 Keycloak Container Volumes and Persistent Data 18 min read
    17. Part 28 Keycloak with Docker vs Podman Coming soon
  3. 3 Realms, Users, Groups, Roles and Clients 12 lessons · ~2h 30m
    1. Part 29 Keycloak Realms Explained 12 min read
    2. Part 30 Create and Manage Users in Keycloak 11 min read
    3. Part 31 Keycloak Groups and Nested Groups 10 min read
    4. Part 32 Keycloak Realm Roles vs Client Roles and Composite Roles 12 min read
    5. Part 33 Keycloak Clients Explained 13 min read
    6. Part 34 Public vs Confidential Clients in Keycloak 9 min read
    7. Part 35 Keycloak Client Scopes Explained 17 min read
    8. Part 36 Keycloak Protocol Mappers and Custom Token Claims 13 min read
    9. Part 37 Keycloak Service Accounts and Client Credentials 12 min read
    10. Part 38 Keycloak User Attributes and User Profile 11 min read
    11. Part 39 Keycloak Default Roles and Default Groups 12 min read
    12. Part 40 Keycloak Sessions and Offline Sessions 18 min read
  4. 4 OAuth 2.0 and OpenID Connect 17 lessons · ~4h 9m
    1. Part 41 Keycloak OpenID Connect Tutorial 20 min read
    2. Part 42 Keycloak Authorization Code Flow 15 min read
    3. Part 43 Keycloak Authorization Code Flow with PKCE 13 min read
    4. Part 44 Keycloak Client Credentials Grant 16 min read
    5. Part 45 Keycloak Refresh Tokens 16 min read
    6. Part 46 Keycloak Offline Tokens 15 min read
    7. Part 47 Keycloak Device Authorization Grant 12 min read
    8. Part 48 Keycloak CIBA Authentication 17 min read
    9. Part 49 Keycloak Token Introspection 14 min read
    10. Part 50 Keycloak Token Revocation 14 min read
    11. Part 51 Keycloak JWKS and JWT Signature Verification 16 min read
    12. Part 52 Keycloak Logout and OIDC RP-Initiated Logout 15 min read
    13. Part 53 Keycloak Standard Token Exchange 15 min read
    14. Part 54 Keycloak DPoP 14 min read
    15. Part 55 Keycloak Pushed Authorization Requests (PAR) 12 min read
    16. Part 56 Why You Should Avoid Keycloak Direct Access Grants 14 min read
    17. Part 57 Keycloak Implicit Flow: Should You Still Use It? 11 min read
  5. 5 Authentication, MFA, Passwords and Passkeys 15 lessons · ~2h 36m
    1. Part 58 Keycloak Authentication Flows Explained 14 min read
    2. Part 59 Create a Custom Keycloak Authentication Flow 11 min read
    3. Part 60 Keycloak Required Actions 12 min read
    4. Part 61 Keycloak Password Policy 12 min read
    5. Part 62 Configure Forgot Password in Keycloak 11 min read
    6. Part 63 Configure Email/SMTP in Keycloak 11 min read
    7. Part 64 Keycloak TOTP Two-Factor Authentication 11 min read
    8. Part 65 Keycloak Passkeys and WebAuthn Tutorial 12 min read
    9. Part 66 Keycloak Passwordless Authentication 22 min read
    10. Part 67 Keycloak Recovery Codes 14 min read
    11. Part 68 Keycloak Conditional Authentication Flows 13 min read
    12. Part 69 Keycloak Step-Up Authentication 13 min read
    13. Part 70 Keycloak SAML Step-Up Authentication Coming soon
    14. Part 71 Keycloak Brute Force Detection Coming soon
    15. Part 72 Keycloak Login and Session Timeout Settings Coming soon
  6. 6 LDAP User Federation 13 lessons · ~9 min
    1. Part 73 Keycloak LDAP User Federation with OpenLDAP 9 min read
    2. Part 74 Keycloak with 389 Directory Server Coming soon
    3. Part 75 Keycloak LDAP Sync Configuration Coming soon
    4. Part 76 Keycloak LDAP User Attribute Mapper Coming soon
    5. Part 77 Keycloak LDAP Group Mapper Coming soon
    6. Part 78 Keycloak LDAP Role Mapper Coming soon
    7. Part 79 Keycloak LDAP `memberOf` Mapping Coming soon
    8. Part 80 Map LDAP Groups to Keycloak Roles Coming soon
    9. Part 81 Keycloak LDAP Search Filters Coming soon
    10. Part 82 Configure Multiple LDAP Providers in Keycloak Coming soon
    11. Part 83 Keycloak LDAP Provider Priority Coming soon
    12. Part 84 Keycloak LDAP Pagination Coming soon
    13. Part 85 Keycloak LDAP Connection Pooling Coming soon
  7. 7 LDAP Troubleshooting 10 lessons
    1. Part 86 Keycloak LDAP Connection Works but Users Do Not Sync Coming soon
    2. Part 87 Keycloak LDAP Groups Not Syncing Coming soon
    3. Part 88 Keycloak LDAP User Exists but Login Fails Coming soon
    4. Part 89 Keycloak LDAP Bind Failed / Invalid Credentials Coming soon
    5. Part 90 Keycloak LDAP Connection Timeout Coming soon
    6. Part 91 Keycloak LDAP Users Not Updating After Sync Coming soon
    7. Part 92 Keycloak LDAP Group Membership Not Updating Coming soon
    8. Part 93 Keycloak LDAP Deleted Users Still Appear Coming soon
    9. Part 94 Keycloak LDAP Duplicate Users Coming soon
    10. Part 95 Keycloak LDAP Mapper Troubleshooting Coming soon
  8. 8 LDAPS, Certificates and LDAP Security 3 lessons
    1. Part 96 Configure LDAPS in Keycloak Coming soon
    2. Part 97 Configure Keycloak Truststore for LDAPS Coming soon
    3. Part 98 Fix Keycloak LDAPS Certificate Errors Coming soon
  9. 9 Microsoft Active Directory Federation 9 lessons · ~1h 37m
    1. Part 99 Integrate Keycloak with Active Directory 11 min read
    2. Part 100 Keycloak Active Directory Group Mapping 10 min read
    3. Part 101 Keycloak `sAMAccountName` vs `userPrincipalName` 11 min read
    4. Part 102 Keycloak AD Users Not Syncing 10 min read
    5. Part 103 Keycloak AD Groups Not Syncing 10 min read
    6. Part 104 Keycloak Active Directory LDAPS 10 min read
    7. Part 105 Keycloak AD Password Authentication Troubleshooting 11 min read
    8. Part 106 Keycloak Kerberos with Active Directory 12 min read
    9. Part 107 Keycloak Kerberos/SPNEGO SSO 12 min read
  10. 10 Identity Brokering 15 lessons · ~10 min
    1. Part 108 Keycloak Identity Brokering Explained 10 min read
    2. Part 109 Keycloak OIDC Identity Provider Coming soon
    3. Part 110 Keycloak SAML Identity Provider/Broker Coming soon
    4. Part 111 Keycloak-to-Keycloak SSO with OIDC Coming soon
    5. Part 112 Keycloak First Broker Login Flow Coming soon
    6. Part 113 Automatically Link Existing Users to External IdP Coming soon
    7. Part 114 Keycloak Identity Provider Mappers Coming soon
    8. Part 115 Map External IdP Groups to Keycloak Roles Coming soon
    9. Part 116 Keycloak IdP Sync Mode: Import vs Force Coming soon
    10. Part 117 Set a Default Identity Provider in Keycloak Coming soon
    11. Part 118 Auto Redirect to IdP with `kc_idp_hint` Coming soon
    12. Part 119 Keycloak Duplicate Email During Identity Brokering Coming soon
    13. Part 120 Keycloak External IdP Logout Not Working Coming soon
    14. Part 121 Retrieve External IdP Tokens from Keycloak Coming soon
    15. Part 122 Keycloak Identity Brokering API v2 Coming soon
  11. 11 Individual External IdP Integrations 7 lessons
    1. Part 123 Keycloak with Microsoft Entra ID Using OIDC Coming soon
    2. Part 124 Keycloak with Microsoft Entra ID Using SAML Coming soon
    3. Part 125 Keycloak Google Login Coming soon
    4. Part 126 Keycloak GitHub Login Coming soon
    5. Part 127 Keycloak GitLab Login Coming soon
    6. Part 128 Keycloak with Okta Using OIDC Coming soon
    7. Part 129 Keycloak with Okta Using SAML Coming soon
  12. 12 SCIM Provisioning 6 lessons · ~1h 41m
    1. Part 130 Keycloak SCIM API Tutorial 21 min read
    2. Part 131 Manage Keycloak Users and Groups with SCIM 20 min read
    3. Part 132 Keycloak SCIM Authentication and Permissions 15 min read
    4. Part 133 Fix Keycloak SCIM 401 and 403 Errors 18 min read
    5. Part 134 How to Provision Microsoft Entra ID Users to Keycloak with SCIM 17 min read
    6. Part 135 Keycloak SCIM vs LDAP: Federation vs Provisioning 10 min read
  13. 13 SAML 15 lessons · ~3h 29m
    1. Part 136 Keycloak SAML SSO: IdP, SP/Broker and Login Flow 17 min read
    2. Part 137 Configure Keycloak as a SAML IdP 8 min read
    3. Part 138 Configure a SAML Client in Keycloak 13 min read
    4. Part 139 Keycloak SAML Metadata: IdP and SP Metadata URLs Explained 13 min read
    5. Part 140 Keycloak SAML Attribute Mapper: Add User Attributes to Assertions 13 min read
    6. Part 141 Map Keycloak Roles and Groups into SAML Assertions 16 min read
    7. Part 142 Keycloak SAML NameID Configuration 15 min read
    8. Part 143 Keycloak SP-Initiated vs IdP-Initiated SAML SSO 14 min read
    9. Part 144 Keycloak SAML Single Logout (SLO) 15 min read
    10. Part 145 Sign and Encrypt Keycloak SAML Assertions 18 min read
    11. Part 146 Fix Keycloak SAML Invalid Signature Errors 15 min read
    12. Part 147 Fix Keycloak SAML Audience Errors 13 min read
    13. Part 148 Fix Keycloak SAML ACS URL Errors 14 min read
    14. Part 149 Keycloak SAML Destination Mismatch 12 min read
    15. Part 150 Decode Keycloak SAMLResponse and SAMLRequest on Linux 13 min read
  14. 14 Keycloak Organizations and B2B IAM 8 lessons
    1. Part 151 Keycloak Organizations Tutorial Coming soon
    2. Part 152 Keycloak Organizations for B2B Multi-Tenancy Coming soon
    3. Part 153 Keycloak Organization Identity Providers Coming soon
    4. Part 154 Keycloak Identity-First Login Coming soon
    5. Part 155 Keycloak Organization Claims in Tokens Coming soon
    6. Part 156 Keycloak Organization Domain-Based IdP Redirect Coming soon
    7. Part 157 Keycloak Delegated Organization Administration Coming soon
    8. Part 158 LDAP Users with Keycloak Organizations Coming soon
  15. 15 Authorization and RBAC 6 lessons
    1. Part 159 Keycloak RBAC Tutorial Coming soon
    2. Part 160 Keycloak Authorization Services Tutorial Coming soon
    3. Part 161 Keycloak UMA and Requesting Party Tokens Coming soon
    4. Part 162 Keycloak Fine-Grained Admin Permissions Coming soon
    5. Part 163 Delegate User Administration in Keycloak Coming soon
    6. Part 164 Restrict Keycloak Admin to Specific Groups/Clients Coming soon
  16. 16 AWS + Keycloak / Cloud IAM 18 lessons
    1. Part 165 Keycloak SSO with AWS IAM Identity Center Using SAML Coming soon
    2. Part 166 Keycloak as SAML IdP for AWS Management Console Coming soon
    3. Part 167 Map Keycloak Groups to AWS IAM Roles Coming soon
    4. Part 168 Keycloak SAML NameID Mapping for AWS Coming soon
    5. Part 169 Fix AWS SAML `InvalidIdentityToken` with Keycloak Coming soon
    6. Part 170 Keycloak + IAM Identity Center User Provisioning Coming soon
    7. Part 171 Keycloak SCIM to AWS Identity Center: Capabilities and Limitations Coming soon
    8. Part 172 Use Keycloak as OIDC IdP for Amazon Cognito Coming soon
    9. Part 173 Use Amazon Cognito as IdP for Keycloak Coming soon
    10. Part 174 Keycloak Behind AWS ALB Coming soon
    11. Part 175 Keycloak Redirects HTTP Instead of HTTPS Behind ALB Coming soon
    12. Part 176 Keycloak ALB Health Check Failing Coming soon
    13. Part 177 Deploy Keycloak on AWS ECS Fargate Coming soon
    14. Part 178 Keycloak with Amazon RDS PostgreSQL Coming soon
    15. Part 179 Store Keycloak Secrets in AWS Secrets Manager Coming soon
    16. Part 180 Send Keycloak Logs to CloudWatch Coming soon
    17. Part 181 Keycloak SAML with Amazon Managed Grafana Coming soon
    18. Part 182 Keycloak SAML with Amazon OpenSearch Coming soon
  17. 17 Reverse Proxy, Hostname and Ingress 9 lessons · ~12 min
    1. Part 183 Configure Keycloak Behind a Reverse Proxy 12 min read
    2. Part 184 Keycloak `KC_HOSTNAME` and Hostname v2 Configuration Coming soon
    3. Part 185 Keycloak `KC_PROXY_HEADERS` and Forwarded Headers Coming soon
    4. Part 186 Keycloak Redirects to HTTP Instead of HTTPS Coming soon
    5. Part 187 Keycloak Wrong Port in Redirect URL Coming soon
    6. Part 188 Keycloak Infinite Redirect Loop Coming soon
    7. Part 189 Fix Keycloak 403 Behind Reverse Proxy Coming soon
    8. Part 190 Keycloak Admin Console Not Loading Behind Proxy Coming soon
    9. Part 191 Fix Keycloak `invalid_redirect_uri` Coming soon
  18. 18 Monitoring, Health and Observability 7 lessons
    1. Part 192 Keycloak Health Checks and Endpoints Coming soon
    2. Part 193 Keycloak Metrics with Prometheus Coming soon
    3. Part 194 Monitor Keycloak with Grafana Coming soon
    4. Part 195 Keycloak Events and Audit Logging Coming soon
    5. Part 196 Keycloak Logging Configuration Coming soon
    6. Part 197 Keycloak OpenTelemetry Coming soon
    7. Part 198 Keycloak User Event Metrics Coming soon
  19. 19 Backup, Restore, Migration and Upgrades 10 lessons
    1. Part 199 Keycloak Backup and Restore Coming soon
    2. Part 200 Keycloak Realm Export vs Database Backup Coming soon
    3. Part 201 Import and Export a Keycloak Realm with `kc.sh` Coming soon
    4. Part 202 Import and Export Keycloak Users Coming soon
    5. Part 203 Keycloak PostgreSQL Backup and Restore Coming soon
    6. Part 204 Restore Keycloak After a Failed Upgrade Coming soon
    7. Part 205 Upgrade Keycloak Safely Coming soon
    8. Part 206 Keycloak Rolling Updates Coming soon
    9. Part 207 Migrate Keycloak Between Servers Coming soon
    10. Part 208 Migrate Keycloak Between Versions Coming soon
  20. 20 High Availability, Clustering and Performance 11 lessons
    1. Part 209 Keycloak High Availability Architecture Coming soon
    2. Part 210 Run Multiple Keycloak Instances in a Cluster Coming soon
    3. Part 211 Keycloak Infinispan Cache Explained Coming soon
    4. Part 212 Keycloak Session Caching Coming soon
    5. Part 213 Keycloak Database Connection Pool Tuning Coming soon
    6. Part 214 Keycloak CPU and Memory Sizing Coming soon
    7. Part 215 Keycloak Performance Tuning Coming soon
    8. Part 216 Keycloak Single-Cluster vs Multi-Cluster HA Coming soon
    9. Part 217 Keycloak Multi-Cluster v2 Coming soon
    10. Part 218 Keycloak Stateless Mode Coming soon
    11. Part 219 Keycloak Multi-Cluster on AWS Coming soon
  21. 21 Admin CLI, REST API and Automation 4 lessons
    1. Part 220 Keycloak `kcadm.sh` Tutorial Coming soon
    2. Part 221 Keycloak Admin REST API Tutorial Coming soon
    3. Part 222 Get Keycloak Admin API Access Token with `curl` Coming soon
    4. Part 223 Keycloak Admin API 401/403 Troubleshooting Coming soon
  22. 22 Application Integrations 10 lessons
    1. Part 224 Protect Nginx with Keycloak and OAuth2 Proxy Coming soon
    2. Part 225 Grafana Authentication with Keycloak OIDC Coming soon
    3. Part 226 Jenkins SSO with Keycloak Coming soon
    4. Part 227 Argo CD SSO with Keycloak Coming soon
    5. Part 228 Kubernetes Authentication with Keycloak OIDC Coming soon
    6. Part 229 Harbor Authentication with Keycloak Coming soon
    7. Part 230 GitLab Authentication with Keycloak Coming soon
    8. Part 231 Spring Boot with Keycloak OIDC Coming soon
    9. Part 232 Python Application Authentication with Keycloak Coming soon
    10. Part 233 Node.js Application Authentication with Keycloak Coming soon
  23. 23 Advanced / Extensibility Topics 7 lessons
    1. Part 234 Keycloak SPI Explained Coming soon
    2. Part 235 Create a Custom Keycloak Authenticator Coming soon
    3. Part 236 Create a Custom Keycloak User Federation Provider Coming soon
    4. Part 237 Keycloak Event Listener SPI Coming soon
    5. Part 238 Create a Custom Keycloak Theme Coming soon
    6. Part 239 Keycloak Custom Protocol Mapper Coming soon
    7. Part 240 Extend Keycloak with Custom Providers Coming soon
  24. 24 Emerging Identity Standards (Monitor) 14 lessons
    1. Part 241 Keycloak AuthZen Authorization Coming soon
    2. Part 242 Keycloak Shared Signals Framework (SSF) Coming soon
    3. Part 243 Keycloak OID4VCI / Verifiable Credentials Coming soon
    4. Part 244 Keycloak Identity Assertion JWT Grant Coming soon
    5. Part 245 Keycloak Token Exchange Delegation Coming soon
    6. Part 246 Keycloak MCP Authorization Coming soon
    7. Part 247 Keycloak Admin API v2 Coming soon
    8. Part 248 Keycloak Workflows Coming soon
    9. Part 249 Keycloak Client Policies Coming soon
    10. Part 250 Keycloak FAPI / Financial-Grade API Profiles Coming soon
    11. Part 251 Keycloak SCIM PATCH vs PUT Coming soon
    12. Part 252 Keycloak SCIM Filters and Pagination Coming soon
    13. Part 253 Keycloak SCIM Custom Attributes and Schemas Coming soon
    14. Part 254 Keycloak SCIM Limitations and Supported Features Coming soon
  25. 25 Red Hat Build of Keycloak 5 lessons · ~12 min
    1. Part 255 Keycloak vs Red Hat Build of Keycloak 12 min read
    2. Part 256 Install Red Hat Build of Keycloak on RHEL Coming soon
    3. Part 257 Red Hat SSO vs Red Hat Build of Keycloak Coming soon
    4. Part 258 Migrate Keycloak to Red Hat Build of Keycloak Coming soon
    5. Part 259 Red Hat Build of Keycloak on OpenShift Coming soon

Hands-on labs

6 guided builds you run yourself

  1. Run Keycloak in a rootless Podman container

    Pull a pinned Keycloak image, start it in development mode on port 8080, and keep realm data in a Podman volume across restarts.

  2. Move Keycloak to PostgreSQL in production mode

    Point Keycloak at an external PostgreSQL database, start it with start, and prove realm data survives replacing the container.

  3. Serve Keycloak over HTTPS with your own certificate

    Enable port 8443 with a PEM or PKCS12 certificate, set the public hostname, and check that the OIDC issuer URL matches it.

  4. Put Keycloak behind Nginx or HAProxy

    Choose edge, re-encrypt, or passthrough TLS, set forwarded-header handling, and fix the 403, wrong-scheme, and wrong-issuer errors that follow.

  5. Issue machine-to-machine tokens with a service account

    Enable a service account on a confidential client, request a client credentials token with curl, and call a protected API with it.

  6. Add custom claims to access and ID tokens

    Map user attributes, groups, and audience into tokens with protocol mappers, then decode the JWT to confirm each claim.

Where to go after this course

  • Keycloak documentationThe upstream server, administration, and upgrading guides. Read the release notes there before moving to a new 26.x release.
  • OpenLDAP courseBuild the directory that the LDAP federation chapters connect Keycloak to.
  • 389 Directory Server courseThe same federation work against the LDAP server behind Red Hat Directory Server and FreeIPA.
  • Kubernetes courseCluster background for the Operator and Helm installs, and for Kubernetes API sign-in through Keycloak OIDC.

Frequently Asked Questions

Is Keycloak free to use in production?

Yes. Keycloak is open source under the Apache License 2.0 and is a Cloud Native Computing Foundation incubation project, so there are no per-user or per-feature license fees. What you pay for is the infrastructure and the time to run it: a database, TLS certificates, upgrades, and monitoring. If you want a vendor to call, Red Hat sells support for its own build of Keycloak.

Should I use upstream Keycloak or the Red Hat build of Keycloak?

The code is the same project. Upstream Keycloak releases more often and gets new features first, which is why this course tracks it. The Red Hat build trails upstream, comes with a subscription and a published list of supported operating systems, JDKs, and databases, and is the usual choice when an organisation needs vendor support. The Keycloak vs Red Hat build of Keycloak lesson covers the differences in detail. Check Red Hat's supported configurations page before you commit to a version.

How does Keycloak compare with Okta, Auth0, or Microsoft Entra ID?

All of them speak OAuth 2.0, OpenID Connect, and SAML, so applications integrate the same way. The difference is who runs it. Okta, Auth0, and Entra ID are managed services priced by users or features. Keycloak runs on your own hosts, which gives you control over data location and customisation in exchange for doing the operations work yourself. The choice is not always either-or: Keycloak can broker logins to Entra ID or Okta, and the identity brokering chapters show how.

Which Java version does Keycloak need?

Upstream Keycloak supports OpenJDK 17, 21, and 25, and recommends the newest supported JDK for production performance. The official container image uses OpenJDK 21, so this only matters when you install the ZIP distribution or build custom extensions. See the supported configurations page for the current list, since it changes between releases.

Can I run start-dev in production?

No. Development mode uses the embedded H2 database, allows plain HTTP, and relaxes hostname checks so you can experiment quickly. Production mode, started with start, expects HTTPS, a configured hostname, and an external database such as PostgreSQL. The start vs start-dev lesson walks through the switch.

Are SCIM and Organizations ready for production?

Organizations has been a fully supported feature since Keycloak 26.0. The SCIM API is a preview feature in 26.7: it is disabled by default and you turn it on with the scim-api feature flag. Preview features can change between minor releases, so read the release notes before you depend on one.

Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with 15+ years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive experience, he excels across development, DevOps, networking, and security, delivering robust and efficient solutions for diverse projects.

Expertise
  • Go (programming language)
  • Python (programming language)
  • DevOps
  • Computer Security
  • Cloud Computing
  • Kubernetes
  • Linux
  • Ansible (software)