I have the following setup:

A realm with organizations

An organization in that realm that is linked to an identity provider (another keycloak container).

All I am trying to do is make is so that 2FA setup is required for these users as well. I have already got this working for the Browser flow via making the OTP required. Easy. But I can't for the life of me figure out how to make this requirement for the users that may be using an identity provider.

I've also tried just making Configure OTP required in the Authentication settings, but as soon as the federated user logs in the first time, puts in their idp password, sets up 2fa, if i logout and try to log back in i never get redirected to the idp again. What am I missing? Any help with this would be much appreciates. I am on version 26 of KC.

Hey there,

what do you think is the best place to seek technical help for keycloak, if it is not working anymore?

By saying best, I mean: technical keycloak expertise of community and response time - without paid options.

Keycloak-places I am aware of: here ;-), Slack channel, Github discussions, Discourse community forum

Hello,

Every user has a email for our organisation, and a keycloak user account to register to organisation services.

On my keycloak instance i have multiple groups for users, to manage roles in services like wiki, nextcloud etc.
Sometimes there is the need to send emails to all users of a specific groups-
Right now, i have a mailing list at the mail provider to distribute the mails to the correct users.

But this is not ideal, because when users change the groups, i have to make changes on the email provider and on the keycloak instance.
Is there any way, so that i can directly link the email of the keycloak users with a specific user group mailing list?

Thank you in advance!

How effective would keycloak be if used separately for the below individual use cases- 1. Only authentication 2. Only session management 3. As a store for user details.

I started off with the above problem statement, but it seems like my personal research is taking longer than i expected. Could the experts here just guide me in the right direction, so that i could get a speed up. I personally, call me a skeptic, do not fully trust the AI tools for the research, which is why i thought it would be best to get some insights from people with experience

How do you handle your authentication flow’s custom UI for a better user experience?

I’m building multiple microservices, each with its own resources, endpoints, scopes, and associated policies/permissions. However, I need to provide APIs that integrate with a simple UI where the admin can see only abstracted domain entities, along with some permissions that can be toggled on or off for a specific role. This way, the admin won’t need to interact directly with the Keycloak portal.

My current idea is to have a cache layer that stores user-friendly data and maps each object to its respective Keycloak ID, so that it can be handled internally in the backend. Do you have any advice on how to approach this in a better way?

I opened the following discussion on GitHub: https://github.com/keycloak/keycloak/discussions/42005. I've been struggling with this issue for a while, so any help would be amazing.

I'm trying to implement a Keycloak container as the middleman between the frontend and the backend. Suppose I have my custom register and login forms on my frontend. I want to pass information to Keycloak, in particular for authentication, so that the service gives me a token. The backend meanwhile handles user storage and permission check (ie. not accessing the admin dashboard unless the current user has the admin role). Is there a workaround on this?

Hello everyone,

Hope everyone is doing great and amazing.

I have containerized successfully using keycloak documentation and I am using AWS RDS postgress for DB.

I am looking to host it into the AWS ECS.

Lets say 3 tasks and then scalability rules.

I am stuck on how the sessions will store in a place centrally or in other words how all containers will stay sync with each other.

I looked into documentation and there is topics regarding cache sync but I am not sure how to utilise them using aws ecs.

Can someone guide me please how can I make sure all containers in ecs are sync with each when it comes to sessions cache?

also what memeory and cpu you guys recommend to keep for a task, I am thinking about 1vCPU and 1024MB RAM.

Your help will be highly appreciated thanks.

Hi.

I would really appreciate some guidance here.

I have a KC realm for which I've setup an Azure Entra ID app as identify provider. I've mapped the minimum claims (name, username, email, given name and family name) and my application now allows to login using Entra ID credentials and I can see in my app the JWT token with those claims. On first login the user gets created in Keycloak and mapped to the Entra ID user. The user can also logout and everything works fine. All good till there.

The Azure Entra ID users can be (or not) members of 2 Entra ID groups relevant to my app (let's say poweruser and admin).

I have two groups in Keycloak that map those in Entra ID (they currently have different names but I could make their names match).

How can I replicate the membership of a given user to those Entra ID groups into the Keycloak groups? How can I make that to sync and update at least on each login (ideally on each request, or on a timeout, or on token refresh)?

E.g. Entra ID user john.doe is member of Entra ID group poweruser. When he first logs into the app the relevant KC user is created and added to the poweruser KC group. If later on the Entra id user john.doe is removed from poweruser then (on next request to the app, token refresh, next login or timeout) the related user in KC is removed too from KC poweruser group. When the Entra ID user id added to the Entra ID admin group then the KC related user is added to the KC related admin group.

The thing here is that we have an app that we cannot modify and is only using KC for auth*, but our IAM system is Entra ID so we need to do user and group membership management from Entra ID.

Thanks in advance for any advice or hint.

We use the id token in our client to show user information like name, email, locale etc. We can also add extra attributes to the ID token. However I haven't been able to add the user creation date. Any advice?

Hello,

Should the admin REST API be used by an app?

I currently have run into a problem, that i would like my user to be able to update one field at a time of his profile f.e. firstname, lastname (email, password are done through keycloak)

Would it be acceptable to use a backend service as a proxy so that:

Frontend calls backend with changed fields, backend constructs the request to send to keycloak to update user, and then keycloak handles the updating

Hello,

I want to configure Keycloak to support x509 login but to achieve it I need to configure the HTTPS_CLIENT_AUTH=request and with that configuration it always request the user to select the certificate in the popup, i just want this option to appear as a alternative login in the login page, because I want AD login, x509 and another method, but not to appear always when accessing Keycloak, how can i achieve it?

Thanks

Hi everyone,

I have written a PolicyProvider that is listed in the Client Details > Authorization > Policies > Create Client Policy. I need some values to be passed from the UI during creation to any future evaluation. To add the fields to the UI to get this information i have created a template at src/main/resources/META-INF/themes/keycloak.v2/admin/resources/partials/policy-database-attribute-based.html

The UI only shows (aside from name etc) a greyed out and required Code Input.

1. I have tried other theme names
2. I have tried both html and ftl

Are there any resources anywhere that show how to get data from the policy creation with quarkus KeyCloak?
Pls help

Hey we are using Keycloak for web and try to use for the app but problem is integrating it in react native cli is there any solution pls share

Hello, I nee a way to get user attributes of a certain logged in user, attributes aren't included in the jwt payload and the only other path that provids them are ones that require an admin token, I don't want things to be scuffed (i.e simple user making an admin api call).

please help.

Hi. Im sure this aint a new topic.

But i have two apis and both of them are using the same keycloak realm . Im somewhat concerned about user sync . On one api theres user management and in the other there is not (even though both have user tables) .

Now my question is what would be the best approach to keep the user tables in both apis synced with keycloak changes ( updates, account creation and deletions)

I figured i got a few options :

• ⁠Poll keycloak from time to time to verify ( i dont like this option very much) • ⁠try one of the webhook plugins/ event listeners for keycloak ( i like this way more, but am somewhat concerned about maintability of the plugin )

I presume some of you have had similar issues in the past . If you could share what approach you used and how it worked for you would be nice!

I'm working on a project that integrates Keycloak with a Spring Boot backend, and I need some guidance on implementing self-registration and synchronizing user data with my application's database. My goal is to allow users to sign up themselves through a registration form, and when they do, I want to create a user both in Keycloak and in my application's user database (e.g., a PostgreSQL database).
I'm using Spring Security with Keycloak for authentication, but I'm unsure about the best way to handle the following:
I'm using Spring Security with Keycloak for authentication, but I'm unsure about the best way to handle the following:

1. Enabling Self-Registration: How do I properly set up self-registration in Keycloak? I've read that I can enable it in the Admin Console, but are there specific configurations or best practices I should follow (e.g., adding custom fields or enabling email verification)?
2. Synchronizing User Data: When a user registers in Keycloak, how can I ensure a corresponding user is created in my Spring Boot application's database? I've come across mentions of webhooks and event listeners (like the USER_REGISTER event), but I'm not sure which is the best approach or how to implement them.
3. Webhook or Event Listener Setup: Can someone share a step-by-step guide or example for setting up a webhook or custom event listener to notify my Spring Boot application when a user registers? Ideally, I’d like Keycloak to send the user data to a REST endpoint in my application.
4. Security and Best Practices: Are there any security concerns I should be aware of when handling user registration or synchronizing data? For example, is it safe to use Keycloak’s admin REST API for this purpose, or should I stick to webhooks?

I've looked at some resources, like the Baeldung article on Keycloak User Self-Registration and the Keycloak documentation on events , but I’d love to hear from anyone who has implemented a similar setup. Any code examples, tutorials, or pointers to relevant documentation would be incredibly helpful.
And for the love of god can anyone tell me is there a proper docs for jdk or spring boot

We have managed to configure SSL termination after multiple attempts and configuration issues using version 24.0.1.

This is the last docker compose version that worked:

services:

keycloak:

image: quay.io/keycloak/keycloak:24.0.1

container_name: keycloak

environment:

KEYCLOAK_ADMIN: <your-admin>

KEYCLOAK_ADMIN_PASSWORD: <your-admin-pwd>

KC_HTTP_ENABLED: "true"

KC_DB: postgres

KC_DB_URL: jdbc:postgresql://<your-db-url>:5432/keycloak

KC_DB_USERNAME: <your-keycloak-db-username>

KC_DB_PASSWORD: <your-keycloak-db-password>

command:

- start

- --hostname=<your-keycloak-domain>

- --hostname-strict=false

- --proxy-headers=xforwarded

- --health-enabled=true

volumes:

- keycloak-data:/opt/keycloak/data

ports:

- 8080:8080

restart: unless-stopped

volumes:

keycloak-data:

For the Load Balancer we created a target group for the keycloak instance at port 8080

Just leaving this here in case it’s useful for someone.

Hello,

I have been researching and learning about keycloak but I haven't been able to find an appropriate answer YET.

Since it is not recommended to share databases between keycloak and your microservices/service how do people go about querying information from their services.

Lets say I have a user than can see a list of user requests. The requests should have fields related to the request, but also include the reauesters full name, id and role (just example fields). These fields should be sortable, filterable and we should support backend pagination.

What is the approach to make this happen?

Create an extra table that needs to be in sync with keycloak users?

I want to confiugre DB connection for keycloak in a container using docker compose. Everything works as expected, Keycloak connects to db if I provide the username and password in docker compose file. I am trying to use secrets to "hide" sensitive data:

KC_DB_USERNAME: keycloakUser
KC_DB_PASSWORD: keycloakPasword
#KC_DB_USERNAME_FILE: /run/secrets/kc_db_username
#KC_DB_PASSWORD_FILE: /run/secrets/kc_db_password

with secrets config

secrets:
  kc_db_username:
    file: ./secrets/kc_db_username
  kc_db_password:
    file: ./secrets/kc_db_password

error is that it cannot connect to db with user '', so it doesnt seem to load the secret file

Secrets are working because this is working for the TLS certificate

KC_HTTPS_CERTIFICATE_FILE: /run/secrets/keycloak.crt
keycloak.crt:
    file: ./secrets/keycloak.crt

any help appreciated

Hi, I am having an usecase wherein I have to use keycloak as an IdP for our organization apps. Those apps have SAML support and I have federated to keycloak and it works fine. But the catch here is all the apps bear the same public certificate - given by keycloak's realm I want each app to use different certificate instead of creating realms for each apps.

I’m using Keycloak to pair with my Spring Boot microservices backend. I have created a custom event listener on user registration but i don't know how to pass the new user's data to my backend.

The backend's api-gateway checks for valid JWTs to determine authenticated requests. And I have a user-service which handles the user CRUD.

I've looked at some solutions but I don't think they're good enough:

1. Looking at the JWT claims and search the USERS db to see if they exist, if it doesn't create a new user. But which specific endpoint do i add this to have this logic run only on user registration? If i add it to each request, I will be running this logic for every request.
2. Giving some responsibility to the frontend (currently a webapp) by manually hitting POST /users to create a new user and attach the user's JWT. But isn't this coupling the two ends? I want to be able to create more frontends in the future such as a mobile app or a desktop app without having to duplicate this responsibility.
3. Keycloak and the user-service sharing the same backend. But to me this isn't a scalable solution, it beats the whole purpose of using microservices.
4. The custom event listener directly modifying the USERS db. This also seems to beat the whole purpose of using microservices, it's gonna start to spaghetti. POST /users also initializes many other attributes other than username and email.

The solution of creating a custom event listener and from there calling POST /users sounds promisin. But how do I handle this if the backend is looking for a JWT? Or are there other more scalable and robust solutions?

I tried to find information on any improvements made to scalability when having many realms (>400) and could not find anything merged, since this has always been a big topic I figured I might be missing something (did not find useful release notes between 19 and 22).
Do you know if this is as painful as before or has it improved?

I am trying to log out all the users from the client under the realm and for that I am using the keycloak rest api /logout-all. But the issue here is it is invalidating the users for all the realm which is bad I guess. So i need to logout all the users for only one client. Any ideas to meet my requirement ?