Keycloak is a production-grade open-source Identity and Access Management (IAM) server. In production it provides authentication and authorization for applications via OIDC/OAuth2, SAML, and emerging standards including OID4VC verifiable credentials (SD-JWT, mdoc, LDP), Shared Signals Framework (SSF/CAEP/RISC), WebAuthn passkeys, and CIBA. The server is a modular Java monolith running on Quarkus, exposing REST admin APIs (v1 plus a feature-gated v2), protocol endpoints, and React-based admin/account consoles, with a Kubernetes operator for managed deployment and CLI tools (kc.sh, kcadm.sh, kcreg.sh). The architecture is built around a pervasive SPI/provider-factory pattern: nearly every subsystem (authentication flows, password hashing, event listeners, user storage federation, token introspection, crypto providers, theme selection) is pluggable via ProviderFactory + Spi interfaces, making the system highly extensible. Persistence uses JPA/Hibernate with Liquibase migrations across PostgreSQL, MySQL, MariaDB, Oracle, and MSSQL; distributed caching and cluster events use Infinispan. The codebase also ships Java and TypeScript admin client libraries and legacy WildFly SAML adapters. Primary data flows: browser/device authentication flows produce signed tokens (access, refresh, ID, userinfo) via pluggable crypto providers (BouncyCastle, FIPS 140-2, Elytron); user/session state flows between the database and Infinispan caches with invalidation events; identity brokering federates users from LDAP, Kerberos, and social IdPs; admin operations emit admin and audit events. Test infrastructure is extensive: a new JUnit 5 test framework with DI annotations coexists with a legacy Arquillian suite (migration in progress), plus Playwright e2e tests for the admin UI. This is purely an application repository - no data pipelines or research artifacts. Notable reusable components include a self-contained SD-JWT implementation, a JOSE/JWS/JWK library, and generic utilities (PathMatcher, Retry) that could be extracted into other Java projects with minimal modification.
This repository is HashiCorp Vault, a production-grade secrets management platform that secures, stores, and controls access to tokens, passwords, certificates, API keys, and other sensitive data. In production, it operates as a distributed system with a Go server backend, a RESTful HTTP API, a CLI client, and an optional Ember.js web UI. The architecture is modular: core server logic (token store, identity store, policy engine, audit brokerage, replication) is extensible via a plugin SDK for custom authentication methods (LDAP, OIDC, Kubernetes, AWS, etc.) and secrets engines (PKI, transit encryption, dynamic database credentials, SSH, etc.). Primary entry points are the `main.go` binary, the `api/` Go client library, and the `command/` CLI package. Data flows involve client requests routed through the HTTP handler to the logical backend, which uses a physical storage abstraction (Raft, Consul, file, etc.) and optionally triggers external plugins over gRPC. The system relies heavily on cryptographic primitives, a lease/expiration manager, and an event pipeline for audit logging and telemetry.