George Thomas

Senior IAM Engineer at Skycloak

George is a senior IAM engineer with 23+ years in software engineering, including 14+ years specializing in identity and access management. He designs and modernizes enterprise IAM platforms with deep expertise in Keycloak, OAuth 2.0, OpenID Connect, SAML, and identity federation across cloud and hybrid environments. Previously at Trianz and a long-term contributor to Entrust IAM product engineering, George authors Skycloak's technical Keycloak tutorials.

32 articles published

KeycloakIdentity and Access ManagementOAuth 2.0OpenID ConnectSAMLIdentity FederationIAM ArchitectureSSO

Articles by George Thomas

Tutorials

Let Product Teams Onboard Apps Without Handing Out Keycloak Admin

Product teams need Keycloak clients. Your IAM team shouldn't hand out admin. Compare the two patterns that work: a self-service…

George ThomasJuly 28, 20269 min read

Tutorials

Keycloak Is Not Your Identity Store: Shadow Accounts and the Broker Pattern

Keycloak rarely owns your users. It keeps shadow accounts, authenticates, and issues a JWT. Where identity, authentication, and authorization really…

George ThomasJuly 23, 202611 min read

Tutorials

Federate or Migrate? Your Legacy User Store Is Now in the Login Path

Federating a legacy user store into Keycloak avoids a big-bang migration, but it puts someone else's database in your login…

George ThomasJuly 21, 202610 min read

Tutorials

Token and Claims Modeling in Keycloak: Reproducing Legacy IdP Behavior

Reproduce legacy IdP tokens in Keycloak so apps survive cutover. Build a claim contract, map UAA/SiteMinder/Okta claims, and diff old…

George ThomasJune 21, 202616 min read

Tutorials

Dual-Run IAM Migration: Switching Identity Providers Without Downtime

An IAM migration strategy for large estates: run old and new IdPs at once, cut apps over in waves, and…

George ThomasJune 20, 202614 min read

Tutorials

Keycloak and SiteMinder Federation: SAML and OIDC Integration Guide

Keycloak SiteMinder integration without a rip-and-replace: run both side by side, federate over SAML or OIDC, and migrate apps at…

George ThomasJune 20, 202615 min read

Articles

SCIM Provisioning from Microsoft Entra ID to Keycloak 26.6+

Learn how to configure SCIM provisioning from Microsoft Entra ID to Keycloak 26.6+, including user sync, deprovisioning, and custom attributes

George ThomasJune 16, 20264 min read

Articles

Microsoft Entra ID Explained for Keycloak Engineers (OIDC)

Every Entra ID concept mapped to its Keycloak equivalent: tenants to realms, app registrations to clients, and where the OIDC…

George ThomasJune 11, 20264 min read

Articles

Protecting Your Applications with Keycloak: A Beginner’s Guide

Learn how to secure applications with Keycloak, map users to local databases, add custom claims, and validate JWTs in Spring…

George ThomasJune 4, 20269 min read

Articles

Keycloak DCR for MCP Servers: Setup with VS Code

Set up Keycloak Dynamic Client Registration (DCR) so MCP clients such as VS Code can register themselves, with Trusted Hosts,…

George ThomasJune 3, 202612 min read