Keycloak is a production-grade open-source Identity and Access Management (IAM) server. In production it provides authentication and authorization for applications via OIDC/OAuth2, SAML, and emerging standards including OID4VC verifiable credentials (SD-JWT, mdoc, LDP), Shared Signals Framework (SSF/CAEP/RISC), WebAuthn passkeys, and CIBA. The server is a modular Java monolith running on Quarkus, exposing REST admin APIs (v1 plus a feature-gated v2), protocol endpoints, and React-based admin/account consoles, with a Kubernetes operator for managed deployment and CLI tools (kc.sh, kcadm.sh, kcreg.sh). The architecture is built around a pervasive SPI/provider-factory pattern: nearly every subsystem (authentication flows, password hashing, event listeners, user storage federation, token introspection, crypto providers, theme selection) is pluggable via ProviderFactory + Spi interfaces, making the system highly extensible. Persistence uses JPA/Hibernate with Liquibase migrations across PostgreSQL, MySQL, MariaDB, Oracle, and MSSQL; distributed caching and cluster events use Infinispan. The codebase also ships Java and TypeScript admin client libraries and legacy WildFly SAML adapters. Primary data flows: browser/device authentication flows produce signed tokens (access, refresh, ID, userinfo) via pluggable crypto providers (BouncyCastle, FIPS 140-2, Elytron); user/session state flows between the database and Infinispan caches with invalidation events; identity brokering federates users from LDAP, Kerberos, and social IdPs; admin operations emit admin and audit events. Test infrastructure is extensive: a new JUnit 5 test framework with DI annotations coexists with a legacy Arquillian suite (migration in progress), plus Playwright e2e tests for the admin UI. This is purely an application repository - no data pipelines or research artifacts. Notable reusable components include a self-contained SD-JWT implementation, a JOSE/JWS/JWK library, and generic utilities (PathMatcher, Retry) that could be extracted into other Java projects with minimal modification.
This repository is a Home Assistant custom component that implements a full OpenID Connect (OIDC) Client/Relying Party for authentication. It allows Home Assistant users to log in via an external OIDC Identity Provider (IdP) such as Authentik, Authelia, Keycloak, or any standard OIDC-compliant server. The integration registers a custom auth provider within Home Assistant's auth system, intercepts the default login flow to redirect users to the OIDC provider, and handles the full authorization code flow including PKCE (RFC 7636), ID token validation with configurable signing algorithms, and userinfo retrieval. It supports both public and confidential clients, device code flow for mobile app login, automatic user linking, role-based access mapping from IdP groups, and a multi-step UI configuration wizard for easy setup.
YAS (Yet Another Shop) is a production-grade, open-source e-commerce platform implemented as a microservices architecture using Java Spring Boot for the backend and Next.js for the frontend (both storefront and admin backoffice). The system is decomposed into ~15 independent microservices (product, cart, order, customer, inventory, payment, promotion, rating, tax, location, media, search, webhook, recommendation, and sample data) that communicate via REST with resilience4j circuit breakers/retries and event-driven patterns using Kafka and Debezium CDC for cross-service data synchronization (e.g., product changes propagate to Elasticsearch for search and PgVector for recommendation). Authentication and authorization are handled via Keycloak with OAuth2/JWT. The architecture includes BFF (Backend For Frontend) gateways using Spring Cloud Gateway and two Next.js frontends. Infrastructure is fully containerized with Docker Compose and Kubernetes Helm charts, with observability via OpenTelemetry, Grafana, Loki, and Tempo. The codebase includes comprehensive unit/integration tests, UI automation tests (Selenium/Cucumber), and CI/CD pipelines per service. While the repository is primarily an application, it incorporates data engineering patterns (CDC, vector embeddings) for the recommendation and search features, giving it a slight hybrid data character. Overall, the code demonstrates solid engineering practices, a well-defined microservice boundary, and several reusable components, though some duplication across services and boilerplate configs exist.
oidc-spa is a production-grade OpenID Connect (OIDC) client library designed for browser-first single-page applications. It implements the Authorization Code + PKCE flow with security-first defaults including in-memory token storage, DPoP (Demonstration of Proof-of-Possession) support, token substitution to prevent token leakage, and browser runtime freezing to resist monkey-patching attacks. The library provides framework-specific adapters for React, Angular, Next.js, Nuxt, TanStack Start, and React Router, each offering hooks, guards, and middleware for seamless authentication integration. It also includes a Vite plugin for build-time injection, a mock OIDC adapter for testing, and server-side utilities for access token validation (RFC 9068). The core is framework-agnostic, with a custom reactive event system (Evt) for state management and cross-tab synchronization via BroadcastChannel. The repository contains extensive example applications demonstrating login/logout, protected routes, role-based access, and auto-logout overlays across multiple frameworks.
This repository is a curated list of resources for learning and using Keycloak, an open source identity and access management solution. It serves as a reference guide, containing links to documentation, books, articles, talks, presentations, videos, client libraries, community extensions, integrations, tools, deployment examples, example projects, benchmarks, help resources, commercial offerings, and miscellaneous resources related to Keycloak. The repository is structured as a single markdown file (README.md) with a detailed table of contents and categorized sections, following the popular 'awesome list' format. There is no executable code; the value lies in the curated collection of links, which is maintained through community contributions. The project includes standard open source files such as a CONTRIBUTING.md file that provides specific guidelines for contributing to the awesome list (referencing the awesome manifesto and detailing requirements for usefulness, formatting, and avoiding duplicates), a CODE_OF_CONDUCT.md based on the Contributor Covenant, and an MIT license. The CONTRIBUTING.md is highlighted as a reusable component for other awesome list projects. The repository is actively maintained, with the most recent commit being recent and ongoing issue activity, indicating a healthy project. Technical drift is low due to the absence of dependencies or code that could become outdated.
This repository provides a set of Keycloak identity provider plugins for Russian social networks: Yandex, VK (legacy API), VK ID (new OAuth 2.0 with PKCE), Mail.Ru, and Odnoklassniki. It extends Keycloak's OAuth2 identity provider framework with custom endpoints, token exchange logic, user profile mapping, and admin UI themes. The architecture follows Keycloak's SPI pattern: each provider has a factory, config, identity provider class, and optional custom callback endpoint. Notable engineering includes PKCE support for VK ID, signature-based API authentication for Odnoklassniki, Basic Auth token exchange for Mail.Ru, and Infinispan-based state caching for VK ID's custom OAuth flow. The code is well-structured, uses modern Java 17 and Jakarta EE, and includes CI/CD pipelines for building and publishing to Maven Central. However, the repository lacks unit tests, which is a significant gap for a production-grade library.