Technology · Agentic → IAM · Open Source · wiki:deep
Keycloak
Keycloak is open-source identity and access management: add authentication to applications and secure services without building your own user store. It provides user federation, strong authentication, user management, fine-grained authorization, and related IAM features. Run from the official distribution (bin/kc.sh start-dev) or container (quay.io/keycloak/keycloak). CNCF-aligned Apache-2.0 project with Java server and client adapters.
Why it matters here
Agents and humans need a shared notion of who is acting. Keycloak is the research default for IdP/SSO/federation in the IAM cell — principals that Cedar/OPA policies can name. Prefer OPA/Cedar for authorization decisions once identity is established; prefer Earned Autonomy Protocol for how execution scope expands with evidence.
How it works
Operators deploy Keycloak as the identity provider. Applications and APIs delegate login/token issuance; Keycloak federates directories, issues tokens, and can enforce authorization settings. Clients use Keycloak adapters/SDKs for OIDC/SAML flows.
- Deploy Keycloak (distro or container).
- Configure realms, clients, users/federation.
- Apps redirect/authenticate via OIDC/SAML.
- Downstream services trust tokens; pair with OPA/Cedar for fine-grained resource authz if needed.
Related: cedar · earned-autonomy-protocol · open-policy-agent · topics/13-governance-policy
Scroll inside the canvas to pan
When to reach for it
- Use when: you need identity, SSO, federation, and user management for humans/services.
- Skip when: you only need a policy engine (opa, cedar) or autonomy methodology (earned-autonomy-protocol) without an IdP.
- Prefer instead: managed IdPs if ops cost dominates; keep OPA/Cedar for resource decisions.
Limits
- Ops weight: realms, HA, upgrades are real SRE work.
- Authn ≠ authz completeness: fine-grained resource rules often still need OPA/Cedar.
- Token misuse: agents holding credentials need vaulting and short TTL — IdP alone is not enough.
- Not the ledger: identity ≠ declared company process authority.
Linked from
Catalog backlinks — what points here (wiki “what links here”).
Features
- access-vs-authority
- agent-identity-interoperability
- autonomy-levels
- deployment-data-residency
- exception-first-participation
- governance
- job-healthcare
- job-hr
- job-security
- live-work-portals
- r2-13-governance-policy
- security-identity-governance
- wt-human-policy
- wt-reuse-deploy-govern
Stacks
Peers
Document management
What we checked
Claims below are backed by science sources on disk.
IdP / IAM product role
keycloak/keycloak · MODERATE
“Open Source Identity and Access Management For Modern Applications and Services”
Docs / operators
Keycloak documentation · MODERATE
“Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users.”
Contrast vs OPA
OPA contrast · MODERATE
“Open Policy Agent (OPA) is an open source, general-purpose policy engine.”
In this research stack
Features and peers linked from the catalog map — not a second product surface.
Features it supports
- access-vs-authority
- agent-identity-interoperability
- autonomy-levels
- deployment-data-residency
- exception-first-participation
- governance
- job-healthcare
- job-hr
- job-security
- live-work-portals
- r2-13-governance-policy
- security-identity-governance
- wt-human-policy
- wt-reuse-deploy-govern
Same cell
Stack
Document management
- affinda
- candice-ai
- docplace
- document-one
- docusafe
- docuville
- dokken
- doxsuite
- egnyte
- eigenpal
- eldoc
- eondocs
- instabase
- klearstack
- kodori
- korto
- laserfiche
- mps-docs
- nectain
- nurie
- paperoffice
- parsewise
- rossum
- vertesia
Source
Primary repo github.com/keycloak/keycloak · Open Source
technologies/keycloak/README.md
Research inventory
9 tags · 41 out · 42 in · 3 artifacts · 0 gaps · 39 corpus docs
Catalog tags
- landscape.layer
- Agentic
- landscape.subcategory
- IAM
- license_tag
- Open Source
- maps.dm
- present
- maps.features
- 14
- one_liner
- Agentic
- review.depth
- science
- slug
- keycloak
- title
- Keycloak
Artifacts
- dm_map · present · technologies/keycloak/document-management.md
- features_map · present · technologies/keycloak/features.md
- readme · present · technologies/keycloak/README.md
Out · alternative_to
- cedartechnology
- earned-autonomy-protocoltechnology
- open-policy-agenttechnology
Out · dm_axis
- affindadm_vendor · dm_vendor
- candice-aidm_vendor · dm_vendor
- docplacedm_vendor · dm_vendor
- document-onedm_vendor · dm_vendor
- docusafedm_vendor · dm_vendor
- docuvilledm_vendor · dm_vendor
- dokkendm_vendor · dm_vendor
- doxsuitedm_vendor · dm_vendor
- egnytedm_vendor · dm_vendor
- eigenpaldm_vendor · dm_vendor
- eldocdm_vendor · dm_vendor
- eondocsdm_vendor · dm_vendor
- instabasedm_vendor · dm_vendor
- klearstackdm_vendor · dm_vendor
- kodoridm_vendor · dm_vendor
- kortodm_vendor · dm_vendor
- laserfichedm_vendor · dm_vendor
- mps-docsdm_vendor · dm_vendor
- nectaindm_vendor · dm_vendor
- nuriedm_vendor · dm_vendor
- paperofficedm_vendor · dm_vendor
- parsewisedm_vendor · dm_vendor
- rossumdm_vendor · dm_vendor
- vertesiadm_vendor · dm_vendor
Out · maps_to
- access-vs-authorityfeature
- agent-identity-interoperabilityfeature
- autonomy-levelsfeature
- deployment-data-residencyfeature
- exception-first-participationfeature
- governancefeature
- job-healthcarefeature
- job-hrfeature
- job-securityfeature
- live-work-portalsfeature
- r2-13-governance-policyfeature
- security-identity-governancefeature
- wt-human-policyfeature
- wt-reuse-deploy-governfeature
In · alternative_to
- cedartechnology
- earned-autonomy-protocoltechnology
- open-policy-agenttechnology
In · dm_axis
- affindadm_vendor · technology
- candice-aidm_vendor · technology
- docplacedm_vendor · technology
- document-onedm_vendor · technology
- docusafedm_vendor · technology
- docuvilledm_vendor · technology
- dokkendm_vendor · technology
- doxsuitedm_vendor · technology
- egnytedm_vendor · technology
- eigenpaldm_vendor · technology
- eldocdm_vendor · technology
- eondocsdm_vendor · technology
- instabasedm_vendor · technology
- klearstackdm_vendor · technology
- kodoridm_vendor · technology
- kortodm_vendor · technology
- laserfichedm_vendor · technology
- mps-docsdm_vendor · technology
- nectaindm_vendor · technology
- nuriedm_vendor · technology
- paperofficedm_vendor · technology
- parsewisedm_vendor · technology
- rossumdm_vendor · technology
- vertesiadm_vendor · technology
In · in_stack
- agentic-iamstack · alternative_slot
In · maps_to
- access-vs-authorityfeature
- agent-identity-interoperabilityfeature
- autonomy-levelsfeature
- deployment-data-residencyfeature
- exception-first-participationfeature
- governancefeature
- job-healthcarefeature
- job-hrfeature
- job-securityfeature
- live-work-portalsfeature
- r2-13-governance-policyfeature
- security-identity-governancefeature
- wt-human-policyfeature
- wt-reuse-deploy-governfeature
Corpus tags
- category
- Agentic → IAM
- dedication
- open-source
- feature
- access-vs-authorityagent-identity-interoperabilityautonomy-levelsdeployment-data-residencyexception-first-participationgovernancejob-healthcarejob-hrjob-securitylive-work-portalsr2-13-governance-policysecurity-identity-governancewt-human-policywt-reuse-deploy-govern
- kind
- map_edgetech_featurestech_quotetech_readmetech_science_sourcetech_section
- needs_deepen
- false
- quality
- ok
- section
- Document management mapEvidenceFeatures mapGitHub mapHow it worksLimits & failure modesLinksScientific notesWhat it isWhen to use / skipWhy it matters here
- slug
- keycloak
- source_id
- keycloak-docskeycloak-githubopa-contrast
- technology
- keycloak
Corpus documents (39)
map_edge · 14
- keycloak → access-vs-authority
- keycloak → agent-identity-interoperability
- keycloak → autonomy-levels
- keycloak → deployment-data-residency
- keycloak → exception-first-participation
- keycloak → governance
- keycloak → job-healthcare
- keycloak → job-hr
- … +6 more
tech_features · 1
- Keycloak · features
tech_quote · 9
- Keycloak · keycloak-docs
- Keycloak · keycloak-docs
- Keycloak · keycloak-docs
- Keycloak · keycloak-github
- Keycloak · keycloak-github
- Keycloak · keycloak-github
- Keycloak · opa-contrast
- Keycloak · opa-contrast
- … +1 more
tech_readme · 1
- Keycloak
tech_science_source · 3
- Keycloak · keycloak-docs
- Keycloak · keycloak-github
- Keycloak · opa-contrast
tech_section · 11
- Keycloak · Document management map
- Keycloak · Evidence
- Keycloak · Features map
- Keycloak · GitHub map
- Keycloak · How it works
- Keycloak · Limits & failure modes
- Keycloak · Links
- Keycloak · Scientific notes
- … +3 more