Insights on Identity, Security & Keycloak
Tutorials, deep dives, and best practices from the Skycloak team.
OAuth Redirect URI Parser Confusion: Why PKCE Does Not Save You
PKCE in OAuth does not protect an auth code sent to the wrong host. How URL parsers disagree on OAuth…
8 min readJWT sub Claim Explained: Unique Only Per Issuer
The JWT sub claim identifies a user only within one issuer. Why your key must be iss plus sub, why…
8 min readWhat Is Entitlement Management? Entitlements vs Roles Explained
Entitlement management controls who holds which specific permission in which system, and for how long. Entitlements vs roles, and where…
10 min readIAM vs PAM: Differences, Overlap and Which You Need First
IAM vs PAM: IAM manages sign-in for everyone, PAM protects the few powerful accounts. Where they overlap and which a…
5 min readWhich Identity Costs Only Show Up After You Sign?
The identity costs that appear after you sign, from enterprise features to support tiers and renewals, plus seven questions to…
6 min readWhat Is Just-in-Time (JIT) Access? JIT vs Standing Privileges
Just-in-time access grants a permission for one task and a limited time, then removes it. How JIT differs from standing…
7 min readWhat Should Your Security Page Say About Login?
What a SaaS security page should say about login: SSO, MFA, sessions, audit logs and offboarding, plus the claims to…
6 min readWho Has to Sign Off When You Replace Your Login Provider?
Who must sign off when you replace your login provider: finance, security, legal, support and app owners, what each needs…
6 min readAccess Token vs Refresh Token: Key Differences
Access tokens authorize API calls briefly; refresh tokens only obtain new tokens. How they differ, and what Gitea 28.1.0 fixed…
8 min readKeycloak Client Secret Rotation in 26.8: How It Works
Keycloak 26.8 makes client secret rotation supported: two secrets overlap during a rotation, but nothing rotates on a timer and…
8 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.