security
Articles tagged with security.
Keycloak 26.7.3 Security Fixes: A Self-Hosted Patch Checklist
Keycloak 26.7.3 fixes twenty CVEs across FGAP v2, OIDC and token exchange. What to re-test after you upgrade, and which…
9 min read
SPIFFE/SPIRE Workload Identity: What a Compromised Node Actually Breaks
Unit 42 showed a root-compromised Kubernetes node can spoof SPIFFE/SPIRE workload identities via cgroup tricks. Here is what actually breaks,…
11 min read
Keycloak Authentication Error Handling: Custom Error Pages
Customize Keycloak error pages, handle OAuth/OIDC errors in your app, and configure brute force protection for secure, user-friendly authentication.
11 min read
Keycloak MFA: Configuration Patterns for Enterprise
How to set up Keycloak MFA: OTP policies, WebAuthn, conditional flows that apply MFA selectively, client-specific overrides, and detecting MFA…
21 min read
What Is HIPAA Compliance? A Complete Guide for 2026
HIPAA compliance means meeting the U.S. rules that protect health data. Learn the HIPAA rules, who must comply, what PHI…
9 min read
Managing Keycloak Secrets the Right Way (Vault SPI)
Keep secrets out of Keycloak config: use the vault SPI to resolve database, SMTP, and client secrets from a file-based…
10 min read
Keycloak Password Policy Best Practices
Keycloak password policies the modern way: length over complexity, breached-password and blacklist checks, hashing iterations, and per-realm enforcement.
9 min read
Secure User Impersonation in Keycloak for Support Teams
Let support staff log in as a user in Keycloak without giving them admin: scope the impersonation role, audit every…
10 min read
Keycloak Brute-Force Protection’s Blind Spot: IP Limits and Lockout DoS
Keycloak brute-force detection is per-account, not per-IP, leaving a password-spray gap and a lockout-DoS risk. How it works, the limits,…
10 min read
How to Verify a Keycloak Access Token on the Backend
Verify Keycloak access tokens on your backend: local JWT signature checks with JWKS, token introspection, claim validation, and Java, Node,…
12 min read
Stay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.