Keycloak capabilities that buyers evaluate one at a time, from SCIM provisioning and user lifecycle workflows to FAPI security profiles and FIPS mode.
Provisioning users and groups into Keycloak from HR systems or identity governance tools through its SCIM API: what the implementation covers, service account permissions, and how SCIM attributes map to the user profile.
Automating joiner, leaver and inactivity steps inside Keycloak with workflows: event-triggered and scheduled steps, notify and disable actions, and where workflows end and a full identity governance tool begins.
Exchanging one token for another in Keycloak: what the supported standard token exchange covers, what still needs the deprecated legacy version, and patterns for service-to-service delegation.
Using Keycloak for financial-grade APIs: FAPI 1.0 and 2.0 profiles enforced through client policies, sender-constrained tokens with DPoP, pushed authorization requests and decoupled CIBA authentication.
Securing Model Context Protocol servers and AI agents with Keycloak: supported MCP versions, resource indicators, client ID metadata documents and the experimental features to enable.
Running Keycloak in FIPS 140-2 mode for regulated environments: the BouncyCastle FIPS libraries, non-strict versus strict mode, keystore and key length limits, and features such as Kerberos that do not work under FIPS.
Capturing login and administrator activity in Keycloak for audits: user and admin event settings, storing representations, event retention and forwarding events to a SIEM through the Listener SPI.
Configuring Keycloak lockout and password rules: temporary and permanent lockout modes, password history, expiry and blacklists, and the Argon2 and PBKDF2 hashing defaults.
Transparent sign-in from domain-joined desktops through Kerberos and SPNEGO in Keycloak, how it combines with LDAP or Active Directory federation, and its incompatibility with FIPS mode.
Centralizing application authorization in Keycloak with resources, scopes, policies and permissions, the policy enforcer, and fine-grained admin permissions for delegated administration.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.