security
Articles about security from the Skycloak team.
Session Management: Cookies vs Tokens vs Server-Side
Cookies vs tokens vs server-side sessions for distributed systems: security trade-offs, 2026 cookie changes, and how Keycloak persists sessions by…
11 min readSecure User Impersonation in Keycloak for Support Teams
Let support staff log in as a user in Keycloak without giving them admin: scope the impersonation role, audit every…
10 min readKeycloak and GDPR: Deleting, Anonymizing, and Purging User Data
A practical GDPR guide for Keycloak: what PII it stores, how to erase or anonymize a user, bulk-purge inactive accounts…
10 min readKeycloak Brute-Force Protection's Blind Spot: IP Limits and Lockout DoS
Keycloak brute-force detection is per-account, not per-IP, leaving a password-spray gap and a lockout-DoS risk. How it works, the limits,…
10 min readKeycloak Refresh Token Rotation: Setup and Best Practices
How to configure refresh token rotation in Keycloak: revoke-on-use, reuse detection, token lifetimes, SPA vs confidential clients, and security best…
11 min readKeycloak UMA 2.0: User-Managed Resource Sharing
A practical guide to User-Managed Access (UMA 2.0) in Keycloak: the permission ticket flow, RPT tokens, resource sharing, and when…
11 min readKeycloak Authorization Services: Policy Types Explained
Keycloak Authorization Services explained: resources, scopes, permissions, and every policy type (role, group, time, regex, JS, aggregate) and when to…
11 min readKeycloak Auditing & Event Logging: The Complete Guide
A complete guide to Keycloak auditing: login and admin events, event listeners, retention, SIEM forwarding, alerting, and security best practices.
16 min readThe Keycloak Security Hardening Checklist
Keycloak security hardening checklist: TLS, proxy and hostname config, brute-force defense, token and session settings, admin access, and audit logging.
10 min readKeycloak CAEP & Shared Signals: Continuous Access Evaluation
What CAEP and the Shared Signals Framework are, where Keycloak's experimental SSF support stands (targeting v26.7.0), and how to approximate…
9 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.