Designing an Agentic AI-Ready Secure Authentication and Authorization Platform
summary
Practical recipe for letting AI agents call energy APIs: an OAuth 2.1 / FAPI-compliant authorization server built on Keycloak with integration for the Model Context Protocol (MCP), using client policies and an OIDC/OAuth template to enforce PKCE and token binding. A reverse-proxy workaround for Keycloak’s metadata URI is already used in production but a merged PR removes that need; Keycloak now implements nearly all FAPI 2.0 requirements and will pass conformance tests in the next release.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker background
- 3:35Authentication and authorization for AI agents
- 7:38Keycloak as O2.1 authorization server
- 12:27Keycloak MCP integration pattern
- 17:14FAPY high security features
- 20:42Keycloak FAPY conformance
- 21:07Keycloak OIG community overview
- 22:22Q&A session
related talks
32mAI Agents with Keycloak in MCP
31mHigh-level API Security
39mSecure Authorization for Agentic AI in Multi-Domain Environments
19mHow to Secure Agents using OAuth
04mYou Don't Need a New Identity Platform for the AI Era
09mNavigating the Identity Abyss in the AI‑Native Era
01h 22mIdentity for AI Agents
25mModel Context Protocol(MCP) Authorization for Enterprise Use Case With Keycloak