Keycloak

An open solution for Single Sign-On and secure identity management.

what we do

What is Keycloak?

Keycloak is an open-source platform for identity and access management (IAM), enabling businesses to introduce Single Sign-On (SSO) and centralised user management.

With Keycloak, users sign in just once and gain secure access to all authorised applications without having to sign in repeatedly. This improves security and convenience by removing the need to manage multiple passwords and accounts across systems. Keycloak is also developed by a community under the stewardship of Red Hat as open-source software, so there are no licence fees.

Migrated from Orchard CMS: keycloak/keycloak.png

what we do

Key features of Keycloak

Single Sign-On (SSO)

User federation

Access control and authorisation

Identity brokering and social login

Multi-factor authentication (MFA)

User account management

Support for open standards

Single Sign-On (SSO)

One login for multiple systems. Users authenticate once through Keycloak and can then access all integrated applications until they sign out. Keycloak also supports single logout: signing out once ends the sessions in all applications at the same time.

User federation

Connect Keycloak to existing user stores, such as LDAP or Active Directory. Keycloak connects to your current directory services or databases, so you can keep using existing user accounts without migrating them.

Access control and authorisation

Centralised management of user roles, groups and permissions. Administrators can define roles and access policies for individual applications in Keycloak. Keycloak also supports fine-grained authorisation for specific resources and actions, giving you detailed control over who can do what in each application.

Identity brokering and social login

Integration with external identity providers. Keycloak lets users sign in using accounts from other systems or social networks, such as Google or Facebook, if you allow it. It can be configured to accept users from external OpenID Connect or SAML 2.0 identity providers without major changes to your applications.

Multi-factor authentication (MFA)

Support for two-factor authentication and other strong authentication methods. Keycloak can require an additional factor at login, such as a one-time password from a mobile app or SMS, for sensitive applications, strengthening access security.

User account management

A self-service portal for users. Each user can manage their profile through the Keycloak account console: changing their password, updating personal details or managing linked accounts when using social login. This reduces the workload for administrators and improves the user experience.

Support for open standards

Keycloak is built on standard protocols for authorisation and authentication. It supports OpenID Connect, OAuth 2.0 and SAML 2.0, making it easy to integrate with most modern applications and services. Ready-made adapters and libraries for various programming languages and platforms also simplify connecting applications to Keycloak.

what we do

How Keycloak works

Keycloak acts as a central authorisation server in your company’s infrastructure. Applications no longer need to authenticate users independently; instead, they redirect users to Keycloak, where they sign in through a single login page. After successful authentication, Keycloak issues a secure token (such as a JSON Web Token) containing information about the user’s identity and roles. The user returns to the original application with this token, which the application uses to grant access to the required features.

The entire process uses standard OAuth2/OpenID Connect or SAML protocols, so applications can easily integrate Keycloak using common libraries. Thanks to centralised authentication, all your systems trust a single source of truth for user identity, which simplifies the architecture and improves security.

what we do

Benefits of Keycloak for businesses

Stronger security

A better user experience

More efficient IT administration

Faster application integration

Proven technology with no licence fees

Stronger security

Centralised access control makes it easier to enforce security policies, including complex passwords, mandatory two-factor authentication and regular password expiry. Eliminating multiple accounts and passwords reduces potential weak points. Single Sign-On also gives you better visibility into user activity and lets you quickly block access across all systems at once when a security threat arises.

A better user experience

Users, both employees and customers, appreciate signing in once to access all the applications they need. There is no more repeated password entry or separate login for every system, which increases productivity and user satisfaction.

More efficient IT administration

Administrators manage accounts and access centrally in Keycloak instead of in each application. This significantly reduces the administrative workload: add new employees or customers once and assign the roles they need across all systems. When a user leaves, you can simply deactivate or revoke access in one place.

Faster application integration

With Keycloak, it is easy to connect new applications to a unified login system. Developers do not need to build a separate login system for each new application; they integrate it with Keycloak using standard protocols. This shortens the time needed to launch new applications and ensures consistent user management.

Proven technology with no licence fees

Keycloak is an open-source project with a large global user community. Its code is publicly audited and continually improved. Businesses pay no software licence fees, investing only in implementation and any support they need. With no vendor lock-in, you retain full control over the solution. Commercial support is also available, such as the enterprise offering from Red Hat, demonstrating the maturity of the solution.

what we do

BOOTIQ services for Keycloak

To make your Keycloak implementation a success, BOOTIQ offers a complete range of services, from initial analysis to long-term support.

Analysis and solution design

Our experts first analyse your existing systems, security requirements and user needs. We design the optimal deployment architecture for Keycloak within your infrastructure and its integration with your applications. You gain a clear understanding of the process, risks and benefits before implementation begins.

Implementation and integration

We install and configure Keycloak to suit your environment, whether on-premises or in the cloud. We connect Keycloak to your user directories (AD/LDAP) and integrate your applications into the SSO system. We create the necessary realms, roles and rules and, where required, customise the login pages to match your corporate brand. We focus on secure configuration throughout the solution and minimal disruption during deployment.

Support and maintenance

After deployment, we provide continuous support and administration for Keycloak. We monitor availability and performance, apply security updates and new versions, and resolve incidents. You can rely on us for further development, such as connecting new applications, adjusting the configuration or extending integrations.

Training and consulting

We train your administrators and developers to use and manage Keycloak effectively. We offer hands-on training on your own solution and consulting on advanced topics, such as custom authentication flows and integration with additional systems. This gives your IT department the confidence and know-how it needs to work with Keycloak.

what we do

A real-world example – a client implementation

One of our clients, a major financial institution with several thousand employees and dozens of internal applications, faced fragmented user account management. Each application had its own login, and users had to remember many passwords. This created security risks and a heavy workload for IT support.

The solution

BOOTIQ carried out a detailed analysis and proposed deploying Keycloak as a single authentication server. During the project, we integrated Keycloak with the internal Active Directory to retrieve users and automatically assign them to the appropriate roles. We connected all major internal applications, including portals, CRM and internal systems, to Keycloak through OpenID Connect. We also configured two-factor authentication for sensitive applications and single logout to improve security.

The outcome

The client’s employees now use a single account to sign in to all their work applications, which has significantly simplified their daily work. The IT department gained centralised access control, allowing permissions to be granted or revoked quickly from one place. Help desk requests for password resets decreased, and security across the environment improved with the introduction of two-factor authentication. With Keycloak, the client achieved both better security and time and cost savings in user management.

Our clients

Migrated from Orchard CMS: klienti/pre.svg

Frequently asked questions (FAQ)

01Does Keycloak work with our Active Directory and existing applications?

Yes. Keycloak can easily connect to Active Directory or another LDAP server, allowing you to use your existing user database. Your users remain managed in AD, while Keycloak reads their information and validates their passwords in real time. Keycloak also supports standard protocols (OIDC, OAuth2 and SAML), so the vast majority of applications, from modern web applications to legacy systems, can be integrated for Single Sign-On. Keycloak acts as an intermediary that brings your existing systems together into one secure SSO environment without requiring you to replace the applications themselves.

02Is Keycloak really open source? What does that mean for support and updates?

Yes, Keycloak is an open-source project licensed under Apache License 2.0. Its source code is publicly available and free to use, with no software licence fees. Keycloak is developed by a large community and by Red Hat, providing regular updates, patches and feature improvements. For support, you can rely on the community, including documentation and forums, or use professional support. BOOTIQ provides comprehensive support and maintenance for Keycloak in production, so you do not have to manage the solution on your own.

03How secure is Keycloak for business use?

Keycloak is designed with security in mind. It supports modern security mechanisms, from encrypted communication and secure password storage to two-factor authentication. Centralised administration lets you apply security policies consistently, such as minimum password length or locking accounts after a defined number of failed attempts. Keycloak also undergoes regular security audits within the open-source community and among enterprise users. It is used by major companies and public institutions, making it a proven solution. With proper configuration and maintenance, which BOOTIQ can help you with, Keycloak is a highly secure choice for production deployment.

04What size of environment is Keycloak suitable for?

Keycloak is a scalable solution that can be deployed in small businesses and large organisations with millions of users. It can run across a cluster of servers to provide high availability and handle large volumes of authentication requests. There is therefore no fixed limit on the number of users or applications: Keycloak grows with you. Correct configuration and infrastructure sizing are essential, and we can advise you on both. Keycloak already serves environments ranging from dozens to hundreds of thousands of users.

05How is Keycloak deployed, and how long does it take?

Deployment usually involves several stages. First comes analysis and solution design, taking days to a few weeks depending on the complexity of the environment. This is followed by implementation: installing and configuring the Keycloak server, connecting your directories and integrating the first applications into SSO. This stage may take several weeks, depending on the scope of integration. After testing, the solution goes into production and administrators receive training. A basic solution can generally be running within a few weeks of the project starting. BOOTIQ also helps manage the entire project to ensure a smooth rollout. We will provide a specific timeline and plan after a free initial analysis.

Interested in a Keycloak solution?

Get in touch to discuss how Keycloak could work in your organisation. Call us, write to us or arrange a meeting with our specialists today – we will be happy to answer your questions and suggest the next steps…

Get in touch