Insights on Identity, Security & Keycloak
Tutorials, deep dives, and best practices from the Skycloak team.
Keycloak CIBA Lockout Fix: Brute-Force Check Added to Token Redemption
Keycloak 26.7.5 closes a gap where a locked-out user's approved CIBA request could be redeemed for tokens. Who is affected,…
7 min read
OAuth Redirect URI Parser Confusion: Why PKCE Does Not Save You
PKCE in OAuth does not protect an auth code sent to the wrong host. How URL parsers disagree on OAuth…
8 min read
JWT sub Claim Explained: Unique Only Per Issuer
The JWT sub claim identifies a user only within one issuer. Why your key must be iss plus sub, why…
8 min read
IAM vs PAM: Differences, Overlap and Which You Need First
IAM vs PAM: IAM manages sign-in for everyone, PAM protects the few powerful accounts. Where they overlap and which a…
5 min read
Which Identity Costs Only Show Up After You Sign?
The identity costs that appear after you sign, from enterprise features to support tiers and renewals, plus seven questions to…
6 min read
What Is Just-in-Time (JIT) Access? JIT vs Standing Privileges
Just-in-time access grants a permission for one task and a limited time, then removes it. How JIT differs from standing…
7 min read
What Should Your Security Page Say About Login?
What a SaaS security page should say about login: SSO, MFA, sessions, audit logs and offboarding, plus the claims to…
6 min read
Who Has to Sign Off When You Replace Your Login Provider?
Who must sign off when you replace your login provider: finance, security, legal, support and app owners, what each needs…
6 min read
Access Token vs Refresh Token: Key Differences
Access tokens authorize API calls briefly; refresh tokens only obtain new tokens. How they differ, and what Gitea 28.1.0 fixed…
8 min read
Stay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.