What is Keycloak?

Keycloak is an open-source Identity and Access Management (IAM) solution that handles authentication and authorization for applications so you don’t have to. Instead of building login flows, session management, MFA, and token issuance yourself, you integrate your apps with Keycloak and delegate all of that complexity to a dedicated, battle-tested service.

Core Architecture

Keycloak organizes everything into Realms — isolated tenants. Each realm has its own users, clients (applications), identity providers, and authentication flows. You can run one realm per environment (dev/staging/prod) or one realm per product.

# Quick start with Docker
docker run -p 8080:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
  -e KC_BOOTSTRAP_ADMIN_PASSWORD=change_me \
  quay.io/keycloak/keycloak:latest start-dev

Key Features

OIDC / OAuth2 Integration

Any app that supports OIDC can integrate with Keycloak in minutes. Configure a “client” in the admin UI, set redirect URIs, and you’re done:

// Node.js example with passport-keycloak-bearer
const KeycloakBearerStrategy = require('passport-keycloak-bearer');
passport.use(new KeycloakBearerStrategy({
  realm: 'myrealm',
  url: 'https://keycloak.example.com'
}, (jwtPayload, done) => done(null, jwtPayload)));

LDAP / Active Directory Sync

Federate your existing corporate directory into Keycloak. Users authenticate with their AD credentials, and Keycloak issues OIDC tokens your modern apps understand. Bridge the gap between legacy enterprise infra and new services.

Custom Authentication Flows

Keycloak’s authentication flow engine lets you wire together conditions: require MFA only for admin roles, step-up auth for sensitive operations, or custom OTP via SMS. All configurable in the admin UI without code changes.

Fine-Grained Authorization

Beyond role-based access, Keycloak supports attribute-based access control (ABAC) with its Authorization Services. Define policies at the resource level and evaluate them server-side.

Best For

Startups that want enterprise-grade auth without buying Okta or Auth0
Internal tooling with LDAP/AD user directories needing modern OIDC tokens
Microservice architectures requiring centralized token issuance and validation
Teams building multi-tenant SaaS who need realm-per-tenant isolation

Quick Start

Get Keycloak running and protect a Node.js app in under 10 minutes:

# 1. Start Keycloak in dev mode (not for production)
docker run -p 8080:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
  -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
  quay.io/keycloak/keycloak:latest start-dev

# 2. Open http://localhost:8080/admin — log in with admin/admin
# 3. Create a new Realm: "myrealm"
# 4. Create a Client: type "OpenID Connect", client ID "my-app"
#    Set Valid Redirect URIs: http://localhost:3000/*
# 5. Create a test User, set a permanent password

// 6. Install the JS adapter in your app
// npm install keycloak-js

import Keycloak from 'keycloak-js';

const keycloak = new Keycloak({
  url: 'http://localhost:8080',
  realm: 'myrealm',
  clientId: 'my-app',
});

// Initialize — silently checks for existing session
await keycloak.init({ onLoad: 'check-sso' });

if (!keycloak.authenticated) {
  keycloak.login();  // Redirect to Keycloak login page
} else {
  console.log('Token:', keycloak.token);
  // Pass token in Authorization: Bearer <token> to your API
}

For production, replace start-dev with start and configure a PostgreSQL database via KC_DB, KC_DB_URL, KC_DB_USERNAME, and KC_DB_PASSWORD environment variables. Set KC_HOSTNAME to your public domain and terminate TLS at a reverse proxy (nginx or a load balancer) in front of Keycloak.

Keycloak — Open Source Identity & Access Management

✅ Pros

⚠️ Cons