Simple Control: Managing Multi-Domain MCP Access Via Keycloak IdP With ID-JAG
summary
Centralized IdP issues signed identity vouchers (ID-JAG) so MCP clients present a Keycloak-backed JWT to MCP authorization servers, moving authorization out of per-tool silos and eliminating shadow IT and consent fatigue. Implementation uses Keycloak Token Exchange Provider to mint ID-JAG assertions, demoed with Postman and a Stitch-protected backend (Stitch third-party service). Foundational features exist; final issuer work is under review as PR 49998, and the demo flow succeeds end to end.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:24Agenda and MCP OAuth
- 2:06MCP concepts and OAuth roles
- 4:14Enterprise MCP access challenges
- 6:02Siloed admin and shadow IT risks
- 9:38Consent fatigue and user issues
- 11:08IDHub centralized management
- 13:13IDHub flow and token exchange
- 15:01IDHub solves enterprise challenges
- 17:05IDHub in Keycloak status
- 18:49Live demonstration
- 25:53Summary
related talks
25mModel Context Protocol(MCP) Authorization for Enterprise Use Case With Keycloak
17mSponsored Demo: MCP Auth Demo: CIMD With Keycloak
39mSecure Authorization for Agentic AI in Multi-Domain Environments
26mSecure Your MCP Servers with OAuth, JWT, SPIFFE and More
23mOne Login to Rule Them All: Cross-App Access for MCP
32mAI Agents with Keycloak in MCP
09mNavigating the Identity Abyss in the AI‑Native Era
25mSecure Your MCP Servers With OAuth, JWT, SPIFFE and More