Insights on Identity, Security & Keycloak
Tutorials, deep dives, and best practices from the Skycloak team.
Decoding SAMLRequest: What It Is and How to Decode It
A SAMLRequest is the Base64-encoded, deflate-compressed XML authentication request an SP sends to an IdP. Learn how to decode it…
6 min read
Python Authentication: Login Pages Without Storing Passwords
Build a Python login page that never stores a password: Flask and Authlib with PKCE, Keycloak as the identity provider,…
8 min read
Attribute-Based Access Control: How It Works, When to Use It
ABAC evaluates user, resource, action, and environment attributes at request time. See how it compares to RBAC and ReBAC, plus…
9 min read
Social Login Implementation: Step-by-Step Guide (2026)
Step-by-step social login with OAuth authentication: Google, GitHub, and Microsoft setup, Keycloak broker config, duplicate email account linking, and mappers.
9 min read
Keycloak vs Okta: An Honest Workforce IAM Comparison
Keycloak vs Okta compared honestly: real July 2026 pricing, an 11-row scorecard, breach track record, and the password export problem…
10 min read
Keycloak as a SAML Service Provider: Complete Setup Guide
Configure Keycloak as a SAML service provider: broker setup, SP metadata, signature validation, attribute mapping, SLO, and fixes for common…
10 min read
IdP vs SP: The Difference, and How Keycloak Plays Both Roles
IdP vs SP explained: what each role does in SAML and OIDC, and how Keycloak plays both at once through…
7 min read
How to Enable User Registration in Keycloak (26.x Guide)
Enable self-registration in Keycloak 26.x: the Login tab toggle, the new email-first password flow, custom fields via user profile, and…
9 min read
JWT Token Lifecycle: Expiration, Refresh, Revocation, and Spring Boot Validation
JWT lifecycle guide: expiration, refresh token rotation per RFC 9700, Keycloak revocation, and Spring Boot resource server validation with zero…
11 min read
Session Management in Distributed Systems: Cookies vs Tokens vs Server-Side Sessions
Cookies vs tokens vs server-side sessions for distributed systems: security trade-offs, 2026 cookie changes, and how Keycloak persists sessions by…
11 min read
Stay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.