Single Sign-On with Keycloak

Every app has its own login. While you can always log in with the same username and password, it’s a real hassle if you ever want to change your password. Then you’re in for a real finger-twisting ordeal with all those logins.
It would be great to have a centralized system where all users can log in—one that also works in modern distributed architectures, since it allows you to make services “secure.”
In our own software products, we face different challenges: How can we securely authenticate users, and how can we offer those who want it the option to authenticate via social media services (Facebook, Google, GitHub, Twitter)?

Keycloak: A Jack-of-All-Trades

Keycloak can do all of this and can also be integrated with any existing on-premises user directories, such as LDAP or Active Directory. Since Keycloak also supports the Kerberos protocol, it’s possible to integrate services that use Kerberos as their authentication protocol. And all of this, mind you, runs in parallel with the services mentioned above.

Centralized Authentication

Keycloak can therefore provide authentication for just about every service in the company. But what happens if this central authentication service goes down? Well, then no one can log in anymore, so that should be avoided at all costs. But don’t worry—the Keycloak server can be designed and configured as a high-availability (HA) service. Thanks to its built-in replication and failover services, Keycloak can be configured to be fail-safe. There are no technical limitations here.

Keycloak Speaks Multiple Languages

Plugins are available for all common programming languages, and code snippets exist to make getting started with development easy. Additionally, the various authentication exchange formats offered by Keycloak make this tool the top choice for centralized user management. Keycloak can “communicate” with your existing authentication infrastructure—such as LDAP—and then send the required authentication credentials, such as SAML, OpenID Connect, or OAuth 2.0, to your web applications. And it does all of this for each individual web application independently of one another.

Since Keycloak is used as an identity and authorization broker, you can now set up your own services as independent, distributed services, while still allowing users to use the same login and password everywhere. For the users of your services, this represents a significant simplification, and for all application managers within the company, the decentralized services can be added or taken out of service as needed. All of this is, of course, GDPR-compliant, since no data other than logging needs to be shared between these services. Each application can maintain its own data, ensuring that the application development teams only receive the data they need to process.

If you’re interested in learning more about user management, please feel free to contact us.