Single sign-on with Keycloak
Once you run more than a couple of internal applications, a single login across all of them stops being a luxury. Keycloak is the open-source identity server that gives you SSO, MFA and one place to turn an account off.
Keycloak is an identity provider: your applications delegate login to it over OpenID Connect or SAML, and it handles passwords, MFA, and account lifecycle. The payoff is one account per person and one switch to disable them everywhere.
Realms keep worlds apart
A realm is an isolated set of users, clients and settings. Use a separate realm for staff and for customers; never put them in the same one. The master realm is only for administering Keycloak itself — do not put real users there.
It needs a real database
Keycloak stores users and sessions in a relational database. The embedded dev database is for trying it out, not for running it. Give it PostgreSQL — see running PostgreSQL — and back that database up, because it is your identity store.
Always behind TLS
Tokens and credentials cross the wire constantly. Keycloak must sit behind HTTPS, and it needs to know its public hostname so the URLs in tokens are right. Set the hostname explicitly; a mismatch breaks redirects in confusing ways. See TLS certificates.
It is now critical infrastructure
When Keycloak is down, every application that trusts it is down too — nobody can log in. That makes it exactly the kind of service to monitor hard and, eventually, to run in more than one place. See high availability, honestly and monitoring your own server.
Turn on MFA and sensible lockouts
The whole point of central identity is central policy: require MFA, set brute-force detection, and define a password policy once. Then it applies to every application at once, instead of being configured badly in ten places.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base