keycloak-operations
Articles about keycloak-operations from the Skycloak team.
Keycloak Client Secret Rotation in 26.8: How It Works
Keycloak 26.8 makes client secret rotation supported: two secrets overlap during a rotation, but nothing rotates on a timer and…
8 min readKeycloak Redirect URI Change: Fix HTTP Parameter Pollution
Keycloak 26.8 rejects redirect URIs that already carry state, code or session_state, a check that began in July. Why, what…
11 min readKeycloak 26.8 SCIM API: Supported and On by Default
Keycloak 26.8 makes the native SCIM API supported and on by default, but each realm still needs its own toggle.…
13 min readKeycloak Admin API v2: Declarative OIDC and SAML Clients with the Operator
Keycloak 26.7 shipped an experimental Admin API v2 and Operator CRs for clients. Here is what KeycloakOIDCClient actually does, and…
12 min readKeycloak Native SCIM API Preview in 26.7: What It Covers, What It Misses, and When Managed Still Wins
Keycloak 26.7 promotes its native SCIM API to preview behind the scim-api flag. It handles CRUD, PATCH and filtering, but…
9 min readKeycloak SPI ID Collision: Redis Cache Ran on Infinispan
Keycloak's ProviderManager dedupes SPI factories by provider ID before isSupported() runs. A shared "default" ID silently dropped our Redis cache…
11 min readManaging Keycloak Secrets the Right Way (Vault SPI)
Keep secrets out of Keycloak config: use the vault SPI to resolve database, SMTP, and client secrets from a file-based…
10 min readHow Much RAM and CPU Does Keycloak Need in Production?
How much RAM and CPU does Keycloak need? What drives resource use, realistic starting points, JVM heap sizing, and how…
12 min read
Keycloak 26.7 Stateless Mode: Multi-Region Without Infinispan
Keycloak 26.7's stateless preview kills the external Infinispan requirement for multi-cluster. We tested it on YugabyteDB and mapped a multi-cloud…
9 min readMigrating Keycloak From WildFly to Quarkus: A Cutover Guide
Migrate from the legacy WildFly Keycloak distribution to Quarkus: config conversion, the removed /auth path, custom provider changes, and a…
9 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.