Keymateio

Extend Keycloak with enterprise-grade policy control,
seamless multi-tenant IAM, and real-time authorization visibility.

[Keymateio @keymateio]

An authorization check that denies every request looks exactly like a very strict policy.

Istio fails closed by default, which is right. Telling a real outage apart from a policy doing its job is the hard part.

https://t.co/PkyW6vhHzX

[Keymateio @keymateio]

On a default Keycloak realm, a user with roles on two backend services gets a single token that both accept.

Validating the audience does not help. Both are in it.

Eight mistakes, most of them defaults, and how to fix them:

https://t.co/oMyYwZTKKj

[Keymateio @keymateio]

We published a cache benchmark for the Keycloak community, then later worked out we had been reading it wrong.

When the server slows, the offered load drops with it. The test never asks for more than the server is already managing.

https://t.co/TAaFdYRxhr

[Keymateio @keymateio]

IAM is not a login problem.

The failures that hurt are silent: the right identity reaching the wrong data, with no alert and no failed login.

We wrote the guide we wish existed: IAM, IGA, PAM, CIAM, FGA, and where each one actually fits.

https://t.co/eOKvWY5S3j

[Keymateio @keymateio]

Keycloak’s embedded Infinispan uses Protobuf for caching, but try loading a custom runtime .proto file without rebuilding the image you’ll hit a brick wall.
Here is how we built a runtime directory-scanning extension
https://t.co/6k8jPbrQGO

[Keymateio @keymateio]

We are proud to be a Gold Sponsor at Kubernetes Community Days Istanbul 2026! 💙

On Saturday, July 11, Halil Özkan and Ali Tuğrul PINAR will be taking the stage to present: "Zero-Code Service Authorization on Kubernetes: Keycloak Decisions Enforced with Istio Ambient"

[Kubernetes Community Days Istanbul @kcdistanbul]

💙 Meet our Gold Sponsor: Keymate

@keymateio helps organizations build secure, scalable identity and access management by extending Keycloak with fine-grained authorization, multi-tenant access control, and policy-driven security.

A huge thank you to Keymate for supporting Kubernetes Community Days Istanbul 2026 and helping us bring the cloud native community together once again. 🚀

See you on 10–11 July at SantralIstanbul!

🎟️ Get your ticket: https://t.co/Y31yqfCQuO

[Keymateio @keymateio]

Keycloak has a powerful native policy engine built for authorization if you actually know how to wire it.
Here is the exact structural blueprint of how Resources, Scopes, Policies, and Permissions fit together under the hood: 👇
https://t.co/yIQgkfiNwA

[Keymateio @keymateio]

The demo ran five scenarios against one policy: one GRANT, four DENYs.
The agent was also prompted to override the rules mid-session. It couldn't because the decision wasn't in its context.
That's the point.
Full breakdown: https://t.co/16iHtpqQek

[Keymateio @keymateio]

We demoed an AI agent at Java Day Istanbul 2026 and tried to social-engineer it into bypassing its own authorization rules.
It refused. Every time.
Not because the agent was smart. Because the auth decision wasn't the agent's to make.

[Keymateio @keymateio]

DENY decisions stop here. GRANT decisions continue to Keycloak.
Three components:

Access Rules: declarative YAML policy artifacts
Access Rule Engine: centralized CEL evaluation
kmctl authz: design-time CLI for validate / simulate / explain

Same engine at design time and runtime

[Keymateio @keymateio]

The exact policy and scenarios we ran on stage are in the repository, so anyone can reproduce the flow and point the engine at their own access patterns. 🔗 Full Blog Post: https://t.co/o2fT1afbyi📦 GitHub Repo: https://t.co/WbUHvB2JHJ

[Keymateio @keymateio]

Once an AI agent has a valid token, who decides what data it can actually reach?

At Java Day Istanbul 2026, we spent 25 minutes on that single question.

[Keymateio @keymateio]

We demonstrated it with one policy (agent-invoice-read), five scenarios (one GRANT, four DENY paths), and a live walkthrough of a denied decision condition by condition. We also made open-source the design-time side of this work as the Keymate Authz Toolkit (Apache-2.0).

[Keymateio @keymateio]

Want to see the full architecture, configuration steps, and how we align Keycloak with CIS Benchmarks & NIST standards at Keymate?

Check out our full technical guide here:
https://t.co/97YFdaJQBc

[Keymateio @keymateio]

Deploying standard Keycloak images straight to production?

You might be handing a bloated attack surface to attackers (and failing your compliance audit).

Here is how to build an Enterprise-grade, hardened Keycloak container image that drops CVE noise by up to 95%. 👇

[Keymateio @keymateio]

3/ Strip the Shell 🛠️
Attackers love `/bin/sh` or `/bin/bash` for Remote Code Execution (RCE).

If your production Keycloak container doesn't need a shell to run, strip it out during a multi-stage Docker build. No shell, no easy shell access.