please-open.it

keycloak as a service on @clever_cloud

We can help you on your authentication

[please-open.it @PleaseOpen_It]

A few months ago, we launched a "Keycloak as a Service" offering with a partner: @clever_cloud

The product evolves with each iteration: IP filter, metrics, HA, autoscale, OAuth2proxy for all runtimes...

Here's a quick overview of everything we've done.
https://t.co/YmTCnxgupZ

[please-open.it @PleaseOpen_It]

Secondary Email in Keycloak:
https://t.co/ocKXXPuM7Q

allow users to add a verified secondary email and choose which one to share during authentication.

[please-open.it @PleaseOpen_It]

@clever_cloud https://t.co/8mupa4l9hq

https://t.co/oXW0Wiiwzn

[please-open.it @PleaseOpen_It]

with @clever_cloud we just released a new version of Keycloak
- Keycloak version 26.6.1 (Workflows, SCIM...)
- Per-realm IP filtering (based on caddy) !
- CC_KEYCLOAK_ADMIN_IPS
- CC_KEYCLOAK_ADMIN_IPS_<REALM>
- CC_KEYCLOAK_PUBLIC_IPS_<REALM>
- CC_KEYCLOAK_SCIM_IPS_<REALM>

[please-open.it @PleaseOpen_It]

Lock your session without logging out in Keycloak by using a PIN code

https://t.co/lP3zSMi9cx

[please-open.it @PleaseOpen_It]

oauth2proxy configuration generator for Keycloak
https://t.co/Ydn1vQVnoI

[please-open.it @PleaseOpen_It]

European Companies: if you host your data with a US cloud provider, you are not GDPR-compliant. ⚠️
The Cloud Act overrides data location.
Yes, even if your servers are in Europe.
⬇️
https://t.co/OxTr8Wi3tj

[please-open.it @PleaseOpen_It]

An authentication proxy is the best pattern for deploying SSO on existing and new apps.
The proxy is in charge of the authentication mechanism, the application receive authenticated requests with the user's details in HTTP Headers.
https://t.co/XouQ3Bz4qL

[please-open.it @PleaseOpen_It]

@hanxhx_ @YodaBZH @sebi2706 @clever_cloudFR @keycloak super merci ! est-ce que tu as essayé de provisionner plutôt directement depuis un export de royaume ?

Est-ce que le provisioning qu'on te propose via les variables pour créer un client "opentofu" suffiraient pas ?

[please-open.it @PleaseOpen_It]

@hanxhx_ @YodaBZH @sebi2706 @clever_cloudFR @keycloak fabuleux 😍
tu utilises CC_KEYCLOAK_BOOTSTRAP_ADMIN_CLIENT_ID et CC_KEYCLOAK_BOOTSTRAP_ADMIN_CLIENT_SECRET pour ton provisioning automatique ?
Surtout n'hésites pas à nous faire des retours, on essaye de faire le service qui colle le plus avec les demandes client !

[please-open.it @PleaseOpen_It]

After oidc-bash, we tried to make a JWT Decoder in bash. It was so complicated with the signatures!

https://t.co/jxkBAMtRa8

[please-open.it @PleaseOpen_It]

Another module for Keycloak :
user attribute regexp mapper

Because in Keycloak user attributes are multivalued (with ability to aggregate them with "user attribute mapper"), we added a regexp filter only to send back attribute if it matches.

https://t.co/10kHpfnqcP

[please-open.it @PleaseOpen_It]

New Keycloak module : groups regexp mapper. Map only groups (to a token, userinfo...) that only matches to a RegExp

https://t.co/lRbUCAocEK

[please-open.it @PleaseOpen_It]

Keycloak has announced "workflows" as a preview feature. A welcome feature we already implemented years ago with... n8n.

This is how we did :

https://t.co/jeCdEOQJMz

[please-open.it @PleaseOpen_It]

Postgres 18 now supports oauth2.0 authentication 🥳

https://t.co/0kUZmISluM
https://t.co/zMaQPCrxCM

[please-open.it @PleaseOpen_It]

Map HTTP headers to claims in tokens. We built this to support locales during a client_credentials authentication process

https://t.co/MqEkbLU3lQ

[please-open.it @PleaseOpen_It]

We built a desktop JWT decoder, directly accessible from the system tray :

https://t.co/e5pnRPlEO4

https://t.co/hRBFV3GlZZ

[please-open.it @PleaseOpen_It]

An authenticator to match rfc8252 8.12 ! "native apps MUST NOT use embedded user-agents to perform authorization requests and allows that authorization endpoints MAY take steps to detect and block authorization requests in embedded user-agents"
https://t.co/zeV69CtOkY

[please-open.it @PleaseOpen_It]

oidc-bash https://t.co/np98eVSFbi now supports PKCE

thanks to @ricsanfre

[Mathieu Passenaud @mathieupassenau]

Retrouvez-nous le 29/04 pour découvrir ce que @PleaseOpen_It a mis au point avec @clever_cloud pour vous proposer une solution clés en main à base de Keycloak