Keycloak

An open-source Identity and Access Management (IAM) platform backed by Red Hat. Keycloak centralizes authentication with SSO, OAuth 2.0, OIDC, and SAML — supporting social login (Google, GitHub), enterprise LDAP/Active Directory federation, and multi-tenant realms for SaaS applications.

What is Keycloak?

Keycloak is the open-source upstream of Red Hat SSO and is one of the most deployed self-hosted identity platforms. It handles the entire authentication and authorization lifecycle: users log in once to Keycloak and receive JWT tokens (OpenID Connect ID token + access token) that applications validate. Applications never see user passwords — they only see tokens from Keycloak.

The realm is Keycloak's unit of isolation — each realm has independent users, clients, roles, and identity providers. For multi-tenant SaaS, each customer gets their own realm with their own SSO configuration. For internal tools, one realm serves all internal applications with role-based access control per application.

Quick Start (Docker)

# Keycloak — development mode
docker run -p 8080:8080   -e KC_BOOTSTRAP_ADMIN_USERNAME=admin   -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin   quay.io/keycloak/keycloak:latest start-dev

# Production mode with PostgreSQL
docker run -p 8443:8443   -e KC_DB=postgres   -e KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak   -e KC_DB_USERNAME=keycloak   -e KC_DB_PASSWORD=secret   -e KC_HOSTNAME=auth.yourdomain.com   -e KC_HTTPS_CERTIFICATE_FILE=/opt/keycloak/certs/cert.pem   -e KC_HTTPS_CERTIFICATE_KEY_FILE=/opt/keycloak/certs/key.pem   quay.io/keycloak/keycloak:latest start

# Admin UI: http://localhost:8080

Next.js Integration (NextAuth.js)

// Next.js — Keycloak via NextAuth.js
// app/api/auth/[...nextauth]/route.ts
import NextAuth from 'next-auth';
import KeycloakProvider from 'next-auth/providers/keycloak';

const handler = NextAuth({
  providers: [
    KeycloakProvider({
      clientId: process.env.KEYCLOAK_CLIENT_ID!,
      clientSecret: process.env.KEYCLOAK_CLIENT_SECRET!,
      issuer: process.env.KEYCLOAK_ISSUER,
      // e.g.: https://auth.example.com/realms/myrealm
    }),
  ],
  callbacks: {
    async jwt({ token, account }) {
      if (account) {
        token.accessToken = account.access_token;
        token.refreshToken = account.refresh_token;
      }
      return token;
    },
    async session({ session, token }) {
      session.accessToken = token.accessToken as string;
      return session;
    },
  },
});

export { handler as GET, handler as POST };

Admin REST API

# Keycloak Admin REST API
# Get admin token
TOKEN=$(curl -s -X POST   "http://keycloak:8080/realms/master/protocol/openid-connect/token"   -H "Content-Type: application/x-www-form-urlencoded"   -d "username=admin&password=admin&grant_type=password&client_id=admin-cli"   | jq -r .access_token)

# Create a realm
curl -X POST "http://keycloak:8080/admin/realms"   -H "Authorization: Bearer $TOKEN"   -H "Content-Type: application/json"   -d '{"realm":"myrealm","enabled":true,"displayName":"My App"}'

# Create a client
curl -X POST "http://keycloak:8080/admin/realms/myrealm/clients"   -H "Authorization: Bearer $TOKEN"   -H "Content-Type: application/json"   -d '{
    "clientId": "web-app",
    "secret": "client-secret",
    "redirectUris": ["https://app.example.com/*"],
    "webOrigins": ["https://app.example.com"],
    "publicClient": false,
    "standardFlowEnabled": true
  }'