Don't Panic — Keycloak Fundamentals

Keycloak is the login server your apps redirect to so they never have to store passwords. Users prove who they are once. Applications receive signed tokens (or SAML assertions) and get on with their jobs.

Before shared IAM servers, every application invented its own accounts table and its own "forgot password" flow. That worked until the third app needed the same people, the same MFA story, and a single logout button that actually logged anyone out. Keycloak replaces that sprawl with one authentication control plane that speaks OpenID Connect and SAML.

Everything hangs off the realm. A realm is an isolated bag of users, clients, roles, and identity settings. One Keycloak process can host many realms. People in realm A do not magically exist in realm B, which is either a feature or a ticket, depending on how you drew the boundaries.

The surprise for newcomers is the master realm. Keycloak creates it at first boot for administrators. It is for creating other realms, not for your product's customers. Put application users and application clients somewhere else. Mixing them is how a broken theme deploy becomes an all-hands identity incident.

A client is any app that asks Keycloak for login or tokens. Confidential clients can hold a secret on a server you trust. Public ones cannot, so browser and mobile apps lean on protections such as PKCE. Roles, groups, and protocol mappers decide what claims land in a token. Leave Full scope allowed on and you may ship every role the user owns to every API. Tokens are not backpacks. They are boarding passes.

Keycloak can federate LDAP directories and broker external identity providers, including social login. In both cases it still issues the local session your apps trust. That split is the whole point: directories and corporate IdPs remain sources of truth for credentials, while Keycloak remains the place applications integrate with.

Operate it with the Admin Console when you are exploring, and with the Admin CLI when you want the same change twice. Production means TLS, a real database, hostnames that match what browsers see, and admin secrets that are not admin/admin from a getting-started page.

Read the Intro when you want the architecture in full. The Cheatsheet is the pocket map for realm and client decisions. Practice and the Exercise are for kcadm and a first local realm. Field Notes is where teams admit what oversized tokens and WildFly-era runbooks still cost.

Don't Panic — Keycloak Fundamentals

Relevant careers