Keycloak in Practice

You can have single sign-on working by lunchtime. Explaining what the token says takes longer.

The gap is not the product. Keycloak installs in minutes and the admin console explains itself. Then come the questions no tutorial answers: why the login worked but the API said 401, which claim the cluster is actually reading, why the logout did not log anyone out, and who lets you back in when the login server is down.

This book closes that gap the only way it can be closed. You type, and then you read what came back.

Twenty-four chapters, each ending in a working lab that runs on your laptop — in containers and in Kubernetes. No cloud account. No spare server. And, unusually for a book that covers Active Directory, no Windows licence: the directory is Samba, in a container, and the book says exactly where it differs from the real thing.

• Perform a complete OpenID Connect login by hand — a browser, curl and openssl, no library anywhere
• Decode an access token claim by claim and say why an API rejected one that was perfectly valid
• Federate an Active Directory over LDAPS, then broker to an upstream provider instead, and know which to recommend
• Sign in to kubectl with a directory group instead of a certificate
• Put Grafana, a registry and an application that cannot speak the protocol at all behind one login — then disable one person in the directory and time how long each application keeps letting them in
• Let Vault trust Keycloak, then let Keycloak keep its secrets in Vault, then cut the power and watch Keycloak refuse to start
• Grow a token until a gateway silently refuses it
• Turn a realm you built by hand into Terraform, and read the drift you created without noticing

Two chapters take away your access on purpose. In Chapter 16 you let a Kubernetes cluster trust the Keycloak running inside it, lose that Keycloak, and discover that every command you would use to repair it requires the thing you just broke. In Chapter 20 you watch two systems wait for each other.

Every chapter includes a Break it on purpose section: you cause the failure, read the real error text, then fix it — with as much attention to which system is actually complaining as to the remedy.

Who this is for: platform engineers, SREs, DevOps engineers and security engineers who will be responsible for how everyone else logs in. You do not need prior Keycloak experience, and the book teaches OAuth2 and OpenID Connect from the wire up.

Includes nine appendices, among them every token type decoded in full, a troubleshooting index sorted by error message, and a production readiness review to run against your own installation.

Keycloak and Red Hat are trademarks of Red Hat, Inc. Microsoft and Active Directory are trademarks of Microsoft Corporation. This book is an independent publication and is not affiliated with, authorized by, or endorsed by any of them.