Useful concepts to understand when using Keycloak
As developer working with user facing apps authentication and authorization is one key aspect of application access that one considers seriously and has a lot of implications if not done well. Many strategies can be used to achieve this and one of them is by using Keycloak.
In order to use Keycloak here are some important concepts relating to user management that are useful and important to understand.
What is Keycloak?
Keycloak is an open-source identity and access management solution. It provides features such as single sign-on, user management, and authentication for applications and services. Keycloak can be used as a standalone application, or it can be integrated with other systems to provide centralized authentication and authorization services.
User identity
In the context of authentication and access management, a user identity refers to the set of attributes or information that uniquely identifies a user and verifies their claim to a particular identity. This information can include details such as a username, email address, and password, as well as other data like security questions, biometric data, or government-issued ID numbers. User identity can also include attributes and roles that are used to determine the level of access a user has to different systems or resources. This information is typically stored in a directory or database and is used to verify the identity of a user when they attempt to access a system or resource.
Single sign-on
Single sign-on (SSO) is a feature that allows users to authenticate once and gain access to multiple systems or applications without having to enter their credentials again. This means that after a user has successfully logged in to one system or application, they will not have to enter their credentials again when they access other systems or applications that are part of the SSO system. This improves the user experience and increases security by reducing the number of times a user has to enter their sensitive information. Keycloak provides SSO functionality by allowing users to authenticate once and then access multiple applications or services that are protected by Keycloak without having to enter their credentials again.
Identity brokering
In Keycloak, identity brokering refers to the ability to connect and delegate authentication to external identity providers (IdP) such as social media providers like Facebook, Google, or other SAML or OIDC identity providers. By configuring an identity broker, users can authenticate with their existing social media or other external identities, while Keycloak acts as a service provider (SP) and handles the communication with the external IdP. This allows users to authenticate to your application with their existing external identities, without having to create new accounts.
Identity provider
An identity provider (IdP) is a system or service that provides authentication for users. It is responsible for verifying the identity of a user by authenticating their credentials, such as a username and password. Once the identity of the user has been established, the identity provider issues a token or assertion that can be used to authenticate the user to a service provider (SP) such as an application or website. IdPs can be internal to an organization or external, like social media providers. Examples of external IdP are Google, Facebook, Microsoft, Salesforce, etc. In Keycloak, these external IdP can be integrated via identity brokering.
User federation
In Keycloak, user federation refers to the ability to connect and synchronize users from external sources such as databases, LDAP directories or cloud-based services into Keycloak's internal user storage. This allows you to manage and authenticate users from those external sources through Keycloak, without having to create and maintain duplicate user accounts within Keycloak itself. User federation can be set up for a specific realm or for the entire Keycloak system.
Realm
It is a term used in the context of Keycloak and identity and access management systems in general to refer to a container for a set of users, roles, clients, and other resources that are isolated from other realms. The term "realm" is derived from the concept of a domain or a separate sphere of authority, and it is used in Keycloak to represent a specific part of the organization or application that needs its own set of users, roles, and policies.
In Keycloak, a realm is a container for a set of users, roles, clients, and other resources that are isolated from other realms. A realm can represent a single organization, a specific business unit, or a group of related applications. Each realm has its own configuration, users, roles, clients, and policies that are separate from other realms.
Keycloak allows administrators to create multiple realms, each with its own set of users, roles, clients, and policies. This allows for a high level of flexibility and isolation for different parts of the organization or different applications. The administrator can also assign different roles and permissions to different users within each realm. This enables keycloak to handle different types of access and authorization required by different applications.
In summary, a realm in Keycloak is a way to organize and manage the users, roles, clients, and resources within a specific part of the organization or application, and to apply different access and authorization policies to them. This allows for a high level of flexibility and isolation between different parts of the organization or applications.