Recent Blog Posts
Keycloak Workflows: Automatically Notify, Disable and Delete Inactive Users 🇬🇧
Creating user accounts is easy. Getting rid of them once nobody needs them anymore is not. In many environments, accounts pile up over the years that nobody has used for months or even years. Each of these accounts is a potential entry point, and the cleanup is usually left to an admin who will do it manually “at some point”. Or not at all.
Read more »Keycloak Workflows: Inaktive Benutzer automatisch benachrichtigen, deaktivieren und löschen 🇩🇪
Benutzerkonten anzulegen ist einfach. Sie wieder loszuwerden, wenn sie niemand mehr braucht, ist es nicht. In vielen Umgebungen sammeln sich über die Jahre Konten an, die seit Monaten oder Jahren niemand mehr benutzt hat. Jedes dieser Konten ist ein potenzielles Einfallstor, und das Aufräumen bleibt meist an einem Admin hängen, der es “irgendwann mal” von Hand macht. Oder eben nicht.
Read more »Delegated User Management with Keycloak: Fine-Grained Admin Permissions (FGAP v2) in Practice 🇬🇧
If you want to hand over administrative rights to other people in Keycloak, you quickly run into a problem: the classic admin roles are coarse. Very coarse.
Whoever gets manage-users manages all users of a realm – not only the ones they are actually supposed to take care of.
With Fine-Grained Admin Permissions (FGAP) version 2, this can be narrowed down properly.
In this article, I use a concrete example to show how it works and where the pitfalls are.
Delegierte Benutzerverwaltung mit Keycloak: Fine-Grained Admin Permissions (FGAP v2) in der Praxis 🇩🇪
Wer in Keycloak Administrationsrechte an andere abgeben möchte, landet schnell bei einem Problem: Die klassischen Admin-Rollen sind grob. Sehr grob.
Wer manage-users bekommt, verwaltet alle Benutzer eines Realms – nicht nur die, um die er sich eigentlich kümmern soll.
Mit den Fine-Grained Admin Permissions (FGAP) in Version 2 lässt sich genau das sauber eingrenzen.
In diesem Artikel zeige ich anhand eines konkreten Beispiels, wie das funktioniert und wo die Stolpersteine liegen.
Keycloak DevDay 2027 - Save the date! 🇬🇧
‼️ Mark your calendars! Keycloak DevDay 2027 is coming back to Darmstadt, Germany, on April 8–9, 2027 ‼️
Read more »Use Custom Infinispan Caches in Keycloak 🇬🇧
When implementing custom Keycloak extensions (aka SPI implementations), the requirement to cache some data may arise from time to time. For example, you might want to cache the results of calls to external systems to reduce dependencies on those systems and speed up things during runtime.
Read more »Keycloak Account REST API OpenAPI Specification 🇬🇧
Finally..! 🙏
Finally I created an OpenAPI Specification file (OAS) for the Keycloak Account REST API.
This API is available since Keycloak version… 12? 14?
I don’t remember anymore exactly.
At least for several years!
But it has never been documented, neither as OAS, nor in any other format.
Unfortunately.
The Keycloak-Token-Configuration Mistake, 90% of all Developers do 🇬🇧
It was my first time at KeycloakCon Europe as a co-located subconference of CNCFCon/KubeCon in Amsterdam in March this year.
I gave a talk about token hygiene, named The Keycloak-Token-Configuration Mistake, 90% of all Developers do (and how to avoid it).
I discussed topics like data-minimization in terms of GDPR and proper token scopes (not using full-scope) with token exchange.
Der Deutschland-Stack ist da – und Keycloak ist die Antwort auf die Frage nach IAM 🇩🇪
März 2026. Ein historisches Datum für die deutsche Verwaltung und für alle Unternehmen, die mit ihr arbeiten, an sie liefern oder sich an ihren Standards orientieren müssen.
Read more »KEYCLOAK DevDay 2026 - It's a wrap! 🇬🇧
I am still impressed and amazed by the great participants, the good atmosphere, the positive feedback, and the many good conversations we had at KEYCLOAK DevDay last week. 🙏 Thank you so much! 🙏
Read more »KeycloakCon Europe 2026 in Amsterdam 🇬🇧
💥 I’m excited to announce, that I’m speaking at KeycloakCon Europe, 23 March in Amsterdam! 💥
Read more »OAuth2 and OIDC vulnerable? 🇬🇧
A few weeks ago I attended a conference talk, where the speaker teased to me in advance, that she will talk about a possible OAuth vulnerability, a combination of open redirects and no proper redirect uri check. That caught my attention…
Read more »KEYCLOAK Friday live chat Xmas edition - Auth.it w/ GR Patil from Phase Two 🇬🇧
This was the Xmas edition of the KFC - KEYCLOAK Friday Chat session, live on YouTube! My new KEYCLOAK community chat format.
Read more »KEYCLOAK DevDay 2026 Schedule is ready! 🇬🇧
We (Niko and Sebastian) want to give you the chance to grab one of the last available tickets for the KEYCLOAK DevDay 2026! DevDay is taking place for the third time, on March 5th and 6th, 2026. Again in Darmstadt, Germany, just 30 minutes away from Frankfurt/Main, see https://www.keycloak-day.dev for details.
Read more »KFC - the KEYCLOAK Friday live chat sessions 🇬🇧
Today, I started a new interactive online format live on LinkedIn events:
Read more »Passwordless Authentication with Passkeys in KEYCLOAK 🇬🇧
It has been possible for a quite long time to authenticate with FIDO2/WebAuthn in Keycloak. But the user experience (UX) was very bad, as the user had to click several buttons and also had to enter a username.
Read more »MFA via Email & SMS is NO proper MFA!!! 🇬🇧
In this video I’ll explain you, why your desired MFA option through email and/or SMS text messages is NO proper multifactor-authentication !
Read more »Keycloak DevDay 2026 Announcement and Call-for-Papers 🇬🇧
We (Niko and Sebastian) are excited to announce the next edition of Keycloak DevDay! DevDay is expanding to a 2-day event taking place again in Darmstadt, Germany on March 5th and 6th, 2026.
Read more »All KEYCLOAK DevDay 2025 videos are published 🇬🇧
It has been a blast!
KEYCLOAK DevDay 2025 was a true success and finally we have published all the videos on my YouTube channel.
Understanding PKCE in OAuth 2.0: What, Why, and When to Use It 🇬🇧
In this video, I break down PKCE (Proof Key for Code Exchange), a crucial enhancement to the OAuth 2.0 Authorization Code Grant. Learn how PKCE works, why it was introduced, and when it’s essential to ensure secure communication between your app and authorization server.
Read more »All Blog Posts / Archive
Read all of my blog posts, find them either by tag or chronological: