Keycloak
An open-source identity and access management solution backed by Red Hat. It supports protocols including OIDC, OAuth 2.0, and SAML, and provides enterprise-grade features such as single sign-on, user federation, and fine-grained authorization.
Timeline (last 90 days)
IAM typically includes an identity provider (IdP), single sign-on (SSO), multi-factor authentication, directory services, and an authorization policy engine; common commercial solutions include Okta and Microsoft Entra ID, and open-source solutions include Keycloak.
The experiment used Keycloak to authenticate two independent service identities: the delegation issuer (trusted, able to issue narrow-scope delegations) and the Agent runtime (which executes the LangGraph workflow and requests authorization before protected operations).
The example in the demo is a stock trading simulator, including a web frontend, a backend written in another language, a message pipeline, and a conversational agent; identity uses Keycloak, and it can also be changed to Entra or federated with on-premises Active Directory.
Keycloak, as an intermediary layer, can simultaneously support connecting to upstream SAML IdPs and issuing OIDC tokens to downstream applications, making SAML invisible to the application side.
In self-hosted scenarios, Authelia, Authentik, and Keycloak are the most common open-source identity provider (IdP) choices.
All Facts (5)
IAM typically includes an identity provider (IdP), single sign-on (SSO), multi-factor authentication, directory services, and an authorization policy engine; common commercial solutions include Okta and Microsoft Entra ID, and open-source solutions include Keycloak.
50%UnverifiedThe experiment used Keycloak to authenticate two independent service identities: the delegation issuer (trusted, able to issue narrow-scope delegations) and the Agent runtime (which executes the LangGraph workflow and requests authorization before protected operations).
50%UnverifiedThe example in the demo is a stock trading simulator, including a web frontend, a backend written in another language, a message pipeline, and a conversational agent; identity uses Keycloak, and it can also be changed to Entra or federated with on-premises Active Directory.
50%UnverifiedKeycloak, as an intermediary layer, can simultaneously support connecting to upstream SAML IdPs and issuing OIDC tokens to downstream applications, making SAML invisible to the application side.
50%UnverifiedIn self-hosted scenarios, Authelia, Authentik, and Keycloak are the most common open-source identity provider (IdP) choices.
50%