Single Sign On with Keycloak: why and how
summary
Argument: centralized SSO removes password sprawl and provides auditability; implementation uses Keycloak + OpenID Connect (JWT access tokens, 5–20 minute expiry, refresh tokens must be guarded). Demonstrations wire Keycloak to Grafana and to legacy apps via Keycloak Gatekeeper, federate with GitLab as an external IdP, and issue Vault OIDC credentials so SSH/DB access uses short‑lived secrets. Notes: Keycloak is a Java/WildFly app, clusterable, supports LDAP/2FA, auditing is available but off by default; demos mostly work with minor configuration hiccups. Vault OIDC login works
AI-written summary · about
chapters (13)
- 0:00Introduction to Keycloak
- 6:47Why passwords are problematic
- 12:53Introduction to IAM and OpenID Connect
- 17:37Keycloak setup and basics
- 21:08Keycloak realms clients and identity providers
- 25:19Securing an application with Keycloak
- 33:27Securing non-OpenID apps with Keycloak Gatekeeper
- 39:51Login with external identity providers
- 47:45Keycloak API and automation
- 50:55Keycloak integration with Vault
- 55:35Keycloak use cases and alternatives
- 58:02Benefits of single sign-on
- 58:46Q&A session
related talks
54mHow to secure your Spring apps with Keycloak
31mDelegate Authentication and a Lot More To Keycloak With OpenID...
54mHow to secure your Spring Apps with Keycloak
53mHow to Secure Your Spring Apps with Keycloak
43mKeycloak + Spring + Vue.js: Seamless SSO Authentication
01h 12mIdentity 2.0: the what, why and how of social and federated login
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
01h 05mSecuring Spring applications with Keycloak