Keycloak in production
From the Authorization Code Flow to federation, six articles on identity that holds
Delegating authentication to Keycloak is a decision you pay for over years: the series walks through the points where it actually breaks. The correct flow and why PKCE is not optional, machine-to-machine authentication, end-to-end tests against an identity provider, delegating policy to OPA, and finally federation with external providers.
Delegating authentication is a decision you pay for over years
Writing authentication by hand is a mistake almost nobody makes any more. Delegating it to an identity provider is the right call, but it is not the end of the problem: it is the start of a series of decisions that are hard to correct. The realm model, which OAuth2 flow to use, where the authorization policies end up, how you test an application that depends on an external service.
They are all choices made at the beginning and paid for over years, because changing them later means going back into every service that talks to authentication.
This series walks through the points where Keycloak actually breaks in production, one per article: the correct flow and why PKCE is not an extra, service-to-service authentication, end-to-end tests against an identity provider, separating authentication from authorization by delegating policy to OPA, and finally federation with external providers.
What you will learn
- ✓ Pick the right OAuth2 flow, and understand why PKCE is not an extra
- ✓ Authenticate services to each other without inventing application tokens
- ✓ Test end-to-end an application that depends on an identity provider
- ✓ Separate authentication from authorization by delegating policy to OPA
- ✓ Federate external providers without duplicating identities
Articles in the series
- 01The login you wrote isn't the problem. The second one is. 8 min
Writing authentication once is cheap. The bill arrives with the second application, and it shows up the day somebody leaves the company.
→ - 02Keycloak Login: Authorization Code + PKCE in MockMart 13 min
Hands-on Authorization Code Flow with PKCE: Keycloak configuration, React frontend integration, and Express backend validation.
→ - 03Keycloak M2M: Authenticating Services Without a User 9 min
How to authenticate machine-to-machine calls between microservices with Keycloak Client Credentials. Setup, code, and common mistakes.
→ - 04Keycloak in Practice: 6 Real-World Integration Problems in an E-Commerce 13 min
6 concrete problems integrating Keycloak with Node.js microservices: issuer mismatch, audience validation, fragile service accounts, and M2M race conditions.
→ - 05Fine-Grained Authorization with OPA and Keycloak: Separating Authentication from Authorization 11 min
How to integrate Open Policy Agent with Keycloak in an Express application to decouple authentication from authorization. Three concrete patterns: RBAC, deny list, and ownership.
→ - 06Keycloak Federation: Integrating Users from LDAP, Okta, Google, and Other Identity Providers 11 min
Keycloak integrates external identities two ways: User Federation syncs users from LDAP or AD, Identity Brokering proxies to Okta, Google and others.
→