Articles by Guilliano Molaire
Keycloak Admin Console on a Separate Hostname with nginx
KC_HOSTNAME_ADMIN does work behind nginx. Serve the Keycloak admin console on a separate hostname with the right proxy headers and…
10 min readKeycloak Refresh Token Rotation: Setup and Best Practices
How to configure refresh token rotation in Keycloak: revoke-on-use, reuse detection, token lifetimes, SPA vs confidential clients, and security best…
11 min readKeycloak Client Scopes Explained: What They Are vs Roles
A Keycloak client scope bundles mappers and role limits that decide what lands in a client's tokens. Default vs optional,…
21 min readKeycloak UMA 2.0: User-Managed Resource Sharing
A practical guide to User-Managed Access (UMA 2.0) in Keycloak: the permission ticket flow, RPT tokens, resource sharing, and when…
11 min readKeycloak Authorization Services: Policy Types Explained
Keycloak Authorization Services explained: resources, scopes, permissions, and every policy type (role, group, time, regex, JS, aggregate) and when to…
11 min readKeycloak on OpenShift (ARO): HA That Survives Audits
Run Keycloak on OpenShift and Azure Red Hat OpenShift in production: operator vs Helm, HA clustering, TLS route modes, and…
8 min read
8 Default Configurations to Adjust Right Away on Your Keycloak Cluster
Optimize your Keycloak cluster by adjusting these 8 critical default configurations for database, HTTPS, email, sessions, grants, admin security, and…
14 min read
How to Configure Microsoft Entra ID as a SAML Identity Provider in Keycloak
Step-by-step guide to configuring Microsoft Entra ID as a SAML identity provider in Keycloak, with attribute mappers, metadata import, and…
13 min readKeycloak Auditing & Event Logging: The Complete Guide
A complete guide to Keycloak auditing: login and admin events, event listeners, retention, SIEM forwarding, alerting, and security best practices.
16 min readKeycloak Backup and Restore: A Practical Guide
How to back up and restore Keycloak: why the database is the source of truth, backing up PostgreSQL, realm exports…
13 min read