Keycloak
Keycloak is an identity and access management server for applications and services.
Why consider Keycloak?
Open Source Identity and Access Management for Modern Applications and Services.
Learn Keycloak by building
Practical setup notes, real use cases, and copy-ready examples in one focused guide.
In this guide4 sections
Open Source Identity and Access Management
Keycloak is an open-source identity and access management solution that lets you add authentication to applications and secure services with minimum effort. Instead of having to deal with storing users or authenticating users yourself, Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more out of the box.
Configuration Sources
Keycloak loads the configuration from four sources, which are listed here in order of application: command-line parameters, environment variables, options defined in the conf/keycloak.conf file, and sensitive options defined in a Java KeyStore file. You can choose the format that makes the most sense for your environment.
When an option is set in more than one source, the one that comes first in the list determines the value for that option. For example, a command-line parameter takes priority over an environment variable.
Running Keycloak via Container Images
You can run Keycloak efficiently by creating a custom container image. The default Keycloak container image ships ready to be configured and optimized. Keycloak can be run in a Docker container or any Podman/Buildah environment using a Containerfile.
To achieve the best startup performance, it is recommended to build an image by running the build step during the container build. Running the build step during the container build saves time in every subsequent start phase of the container image.
Creating an Optimized Container Image
You can configure a custom Containerfile to build an optimized Keycloak image with a PostgreSQL database, health and metrics endpoints, and token exchange feature enabled. Below is an official example Containerfile that enables these features and configures PostgreSQL:
FROM quay.io/keycloak/keycloak:{containerlabel} AS builder# Enable health and metrics supportENV KC_HEALTH_ENABLED=trueENV KC_METRICS_ENABLED=true# Configure a database vendorENV KC_DB=postgresWORKDIR /opt/keycloak# for demonstration purposes only, please make sure to use proper certificates in production insteadRUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname "CN=server" -alias server -ext "SAN:c=DNS:localhost,IP:127.0.0.1" -keystore conf/server.keystoreRUN /opt/keycloak/bin/kc.sh buildFROM quay.io/keycloak/keycloak:{containerlabel}COPY --from=builder /opt/keycloak/ /opt/keycloak/# change these values to point to a running postgres instanceENV KC_DB=postgresENV KC_DB_URL=<DBURL>ENV KC_DB_USERNAME=<DBUSERNAME>ENV KC_DB_PASSWORD=<DBPASSWORD>ENV KC_HOSTNAME=localhostENTRYPOINT ["/opt/keycloak/bin/kc.sh"]Security Best Practices
When deploying Keycloak for production, make sure to replace the demonstration certificates with properly signed certificates. Also ensure that your environment provides the appropriate values for database connection parameters.
Related tools
More options with a similar category or technology profile.
diskus
Minimal, fast alternative to du -sh written in Rust using multi-threaded directory traversal.
peco
Simplistic interactive filtering tool for Unix pipelines, process lists, and file trees.
Dapr CLI
Command-line tool for managing Dapr distributed application runtime environments and sidecars.
Freeze
Generate beautiful image screenshots and SVGs of code snippets and terminal outputs.