[
  {
    "id": "keycloak-docs-1",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Keycloak is based on standard protocols and provides support for OpenID Connect, OAuth 2.0, and SAML.",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-2",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/getting-started/getting-started-docker",
    "excerpt": "docker run -p 127.0.0.1:8080:8080 -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:26.7.3 start-dev",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-3",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/getting-started/getting-started-docker",
    "excerpt": "To secure the first application, you start by registering the application with your Keycloak instance",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-4",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/securing-apps/oidc-layers",
    "excerpt": "/realms/{realm-name}/.well-known/openid-configuration",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-5",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Extensible - Customize through code",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-6",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/documentation",
    "excerpt": "Documentation for the Adminstration RESTful API",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-7",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Themes - Customize look and feel",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-8",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Keycloak has built-in support to connect to existing LDAP or Active Directory servers.",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-9",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Keycloak can also authenticate users with existing OpenID Connect or SAML 2.0 Identity Providers.",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-10",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/guides",
    "excerpt": "Import and export realms as JSON files.",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-11",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Through the admin console administrators can centrally manage all aspects of the Keycloak server.",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-12",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Keycloak provides fine-grained authorization services as well. This allows you to manage permissions for all your services from the Keycloak admin console",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-13",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Through the account management console users can manage their own accounts. They can update the profile, change passwords, and setup two-factor authentication.",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-14",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Login once to multiple applications",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-15",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Keycloak provides single-sign out, which means users only have to logout once to be logged-out of all applications that use Keycloak.",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-16",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Enabling login with social networks is easy to add through the admin console.",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-17",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/guides",
    "excerpt": "Check if an instance has finished its start up and is ready to serve requests by calling its health REST endpoints.",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-18",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/guides",
    "excerpt": "Configure Keycloak with a reverse proxy, API gateway, or load balancer.",
    "fetchedAt": "2026-09-04T22:08:35.369Z"
  },
  {
    "id": "keycloak-docs-19",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users.",
    "fetchedAt": "2026-09-04T22:10:53.468Z"
  },
  {
    "id": "keycloak-docs-20",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/getting-started/getting-started-docker",
    "excerpt": "A realm in Keycloak is equivalent to a tenant. Each realm allows an administrator to create isolated groups of applications and users.",
    "fetchedAt": "2026-09-04T22:10:53.468Z"
  },
  {
    "id": "keycloak-docs-21",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "They can also manage users, including permissions and sessions.",
    "fetchedAt": "2026-09-04T22:10:53.468Z"
  },
  {
    "id": "keycloak-docs-22",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Enabling login with social networks is easy to add through the admin console. It's just a matter of selecting the social network you want to add. No code or changes to your application is required.",
    "fetchedAt": "2026-09-04T22:10:53.468Z"
  },
  {
    "id": "keycloak-docs-23",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/securing-apps/oidc-layers",
    "excerpt": "Keycloak exposes a set of endpoints that applications and services can use to authenticate and authorize their users.",
    "fetchedAt": "2026-09-04T22:10:53.468Z"
  },
  {
    "id": "keycloak-docs-24",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Keycloak provides fine-grained authorization services as well. This allows you to manage permissions for all your services from the Keycloak admin console and gives you the power to define exactly the policies you need.",
    "fetchedAt": "2026-09-04T22:10:53.468Z"
  },
  {
    "id": "keycloak-docs-25",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "If you've enabled social login or identity brokering users can also link their accounts with additional providers to allow them to authenticate to the same account with different identity providers.",
    "fetchedAt": "2026-09-04T22:10:53.468Z"
  },
  {
    "id": "keycloak-docs-26",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Customize look and feel",
    "fetchedAt": "2026-09-04T22:10:53.468Z"
  },
  {
    "id": "keycloak-docs-27",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/getting-started/getting-started-docker",
    "excerpt": "This command starts Keycloak exposed on the local port 8080 and creates an initial admin user with the username `admin` and password `admin`.",
    "fetchedAt": "2026-09-04T22:10:53.468Z"
  },
  {
    "id": "keycloak-docs-28",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/getting-started/getting-started-docker",
    "excerpt": "Set **Valid redirect URIs** to `https://www.keycloak.org/app/*`",
    "fetchedAt": "2026-09-04T22:10:53.468Z"
  },
  {
    "id": "keycloak-docs-29",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Once logged-in to Keycloak, users don't have to login again to access a different application.",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-30",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "They can create and manage applications and services, and define fine-grained authorization policies.",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-31",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "users can also link their accounts with additional providers to allow them to authenticate to the same account with different identity providers",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-32",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Allowing users to self-register",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-33",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Enabling forgot password",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-34",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Rotating keys",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-35",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Configuring federated LDAP storage",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-36",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "SSSD and FreeIPA Identity Management integration",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-37",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/documentation",
    "excerpt": "Centrally manage fine-grained permissions for applications and services",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-38",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/securing-apps/oidc-layers",
    "excerpt": "It lists endpoints and other configuration options relevant to the OpenID Connect implementation in Keycloak.",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-39",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/securing-apps/oidc-layers",
    "excerpt": "The dynamic client registration endpoint is used to dynamically register clients.",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-40",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/securing-apps/oidc-layers",
    "excerpt": "you can use it to validate an access or refresh token",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-41",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/documentation",
    "excerpt": "Creating themes and providers to customize the Keycloak server",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-42",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/guides",
    "excerpt": "Configure Keycloak server for FIPS compliance.",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-43",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/guides",
    "excerpt": "Manage Keycloak OIDC and SAML clients declaratively using the operator.",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-44",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/guides",
    "excerpt": "Collect metrics to gain insights about state and activities of a running instance of Keycloak.",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-45",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/guides",
    "excerpt": "Run Keycloak from a container image.",
    "fetchedAt": "2026-09-04T22:13:33.508Z"
  },
  {
    "id": "keycloak-docs-46",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Keycloak can also authenticate users with existing OpenID Connect or SAML 2.0 Identity Providers. Again, this is just a matter of configuring the Identity Provider through the admin console.",
    "fetchedAt": "2026-09-04T22:15:35.596Z"
  },
  {
    "id": "keycloak-docs-47",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "You can also implement your own provider if you have users in other stores, such as a relational database.",
    "fetchedAt": "2026-09-04T22:15:35.596Z"
  },
  {
    "id": "keycloak-docs-48",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Users can also manage sessions as well as view history for the account.",
    "fetchedAt": "2026-09-04T22:15:35.596Z"
  },
  {
    "id": "keycloak-docs-49",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "If role based authorization doesn't cover your needs, Keycloak provides fine-grained authorization services as well. This allows you to manage permissions for all your services from the Keycloak admin console and gives you the power to define exactly the policies you need.",
    "fetchedAt": "2026-09-04T22:15:35.596Z"
  },
  {
    "id": "keycloak-docs-50",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/getting-started/getting-started-docker",
    "excerpt": "Fill in the form with the following values: **Client type**: `OpenID Connect` **Client ID**: `myclient`",
    "fetchedAt": "2026-09-04T22:15:35.596Z"
  },
  {
    "id": "keycloak-docs-51",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/getting-started/getting-started-docker",
    "excerpt": "As a user in the Account Console, you can manage your account including modifying your profile, adding two-factor authentication, and including identity provider accounts.",
    "fetchedAt": "2026-09-04T22:15:35.596Z"
  },
  {
    "id": "keycloak-docs-52",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/securing-apps/oidc-layers",
    "excerpt": "The introspection endpoint is used to retrieve the active state of a token. In other words, you can use it to validate an access or refresh token.",
    "fetchedAt": "2026-09-04T22:15:35.596Z"
  },
  {
    "id": "keycloak-docs-53",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/securing-apps/oidc-layers",
    "excerpt": "The token revocation endpoint is used to revoke tokens. Both refresh tokens and access tokens are supported by this endpoint.",
    "fetchedAt": "2026-09-04T22:15:35.596Z"
  },
  {
    "id": "keycloak-docs-54",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/guides",
    "excerpt": "Install Keycloak using the Operator.",
    "fetchedAt": "2026-09-04T22:15:35.596Z"
  },
  {
    "id": "keycloak-docs-55",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Managing user attributes",
    "fetchedAt": "2026-09-04T22:15:35.596Z"
  },
  {
    "id": "kc-supp-orgs",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Server Administration Guide, \"Managing organizations\": \"In the Organizations section, you can manage all the organizations in your realm. Creating an organization: Click Create Organization. An organization has the following settings: Name — a user-friendly name for the organization. The name is unique within a realm.\"",
    "fetchedAt": "2026-09-04T22:20:03.000Z"
  },
  {
    "id": "kc-supp-passkeys",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Server Administration Guide documents \"W3C Web Authentication (WebAuthn)\" setup (\"Enable WebAuthn authentication in the default browser flow\", \"WebAuthn together with Two-Factor\", \"LoginLess WebAuthn\") and a dedicated \"Passkeys\" section: \"Passkey Authentication with Conditional UI or autofill\", \"Passkeys Authentication with Modal UI\", \"Passkey Mediation\".",
    "fetchedAt": "2026-09-04T22:20:03.000Z"
  },
  {
    "id": "kc-supp-scim",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Server Administration Guide, \"Managing users and groups through SCIM\": built-in SCIM endpoints per realm (\"Enabling SCIM for a realm\", \"Obtaining the SCIM API base URL\", \"Setting up a service account client\"), with protected admin users excluded: \"resources can only be managed through the Admin Console or the Admin REST API, never through SCIM.\"",
    "fetchedAt": "2026-09-04T22:20:03.000Z"
  },
  {
    "id": "kc-supp-device-grant",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Server Administration Guide, \"Device authorization grant\": \"This is used by clients running on internet-connected devices that have limited input capabilities or lack a suitable browser.\" The OIDC layers reference documents the endpoint: \"/realms/{realm-name}/protocol/openid-connect/auth/device ... used to obtain a device code and a user code.\"",
    "fetchedAt": "2026-09-04T22:20:03.000Z"
  },
  {
    "id": "kc-supp-client-credentials",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/securing-apps/oidc-layers",
    "excerpt": "OIDC layers reference, \"Client credentials\": \"Client Credentials are used when clients (applications and services) want to obtain access on behalf of themselves rather than on behalf of a user.\" Clients authenticate via client_id/client_secret or JWT, backing service accounts for machine-to-machine access.",
    "fetchedAt": "2026-09-04T22:20:03.000Z"
  },
  {
    "id": "kc-supp-kcadm",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Server Administration Guide documents the Admin CLI: Keycloak \"packages the Admin CLI server distribution with the execution scripts in the bin directory. The Linux script is called kcadm.sh\", enabling scripted administration of realms, users, roles, and clients; the same operations are available over the Admin REST API.",
    "fetchedAt": "2026-09-04T22:20:03.000Z"
  },
  {
    "id": "kc-supp-brute-force",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/server_admin/index.html",
    "excerpt": "Server Administration Guide, brute force protection events: \"User disabled by permanent lockout — Brute force protection disabled the user account permanently due to too many login failures. User disabled by temporary lockout — Brute force protection disabled the user account temporarily due to too many login failures.\"",
    "fetchedAt": "2026-09-04T22:20:03.000Z"
  },
  {
    "id": "kc-supp-social-brokering",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Keycloak site, Identity Brokering and Social Login: \"Enabling login with social networks is easy to add through the admin console. It's just a matter of selecting the social network you want to add. No code or changes to your application\" — brokering also covers external OpenID Connect or SAML identity providers.",
    "fetchedAt": "2026-09-04T22:20:03.000Z"
  },
  {
    "id": "kc-supp-federation",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Keycloak site, User Federation: \"Keycloak has built-in support to connect to existing LDAP or Active Directory servers. You can also implement your own provider if you have users in other stores, such as a relational database.\"",
    "fetchedAt": "2026-09-04T22:20:03.000Z"
  },
  {
    "id": "kc-supp-authz-services",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/docs/latest/authorization_services/index.html",
    "excerpt": "Authorization Services guide: fine-grained, resource-level authorization — \"A resource is part of the assets of an application and the organization... In authorization policy terminology, a resource is the object being protected\", with policies evaluated via UMA permission tickets and client-credentials-obtained PATs.",
    "fetchedAt": "2026-09-04T22:20:03.000Z"
  },
  {
    "id": "keycloak-docs-56",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Enabling login with social networks is easy to add through the admin console. ... No code or changes to your application is required.",
    "fetchedAt": "2026-09-16T01:42:35.127Z"
  },
  {
    "id": "keycloak-docs-57",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Keycloak provides fine-grained authorization services as well. This allows you to manage permissions for all your services from the Keycloak admin console.",
    "fetchedAt": "2026-09-16T01:42:35.127Z"
  },
  {
    "id": "keycloak-docs-58",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org",
    "excerpt": "Themes / Customize look and feel",
    "fetchedAt": "2026-09-16T01:42:35.127Z"
  },
  {
    "id": "keycloak-docs-59",
    "tier": "claimed-docs",
    "url": "https://www.keycloak.org/getting-started/getting-started-docker",
    "excerpt": "Switch to a production ready database such as PostgreSQL.",
    "fetchedAt": "2026-09-16T01:42:35.127Z"
  },
  {
    "id": "keycloak-comm-1",
    "tier": "community",
    "url": "https://hn.algolia.com/api/v1/items/31258469",
    "excerpt": "Keycloak is now running on Quarkus, so startup times are much faster (few seconds). It's reliable, flexible and actively developed, so not a bad choice as a self-hosted IAM solution.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-2",
    "tier": "community",
    "url": "https://hn.algolia.com/api/v1/items/31258469",
    "excerpt": "We tried using keycloak in a startup. It needed a loooooooot of memory and was very slow to start... The docker images were also huge. Community support was also relatively not that active.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-3",
    "tier": "community",
    "url": "https://hn.algolia.com/api/v1/items/31258469",
    "excerpt": "In my experience, Keycloak is best treated as a 'pet' in the pet v.s. cattle spectrum. It takes a while to warm up, so you don't want to be constantly restarting it... it doesn't play well with infrastructure-as-code ideas.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-4",
    "tier": "community",
    "url": "https://hn.algolia.com/api/v1/items/31258469",
    "excerpt": "My biggest complaint with Keycloak is that the documentation is poor. You will need to set various flags to fit your use-case. Lots of googling and SO to get things running.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-5",
    "tier": "community",
    "url": "https://hn.algolia.com/api/v1/items/31258469",
    "excerpt": "We have been using it for 6-7 years now. Have been able to run very stable and integrated a lot of external IdP's to offer proper SSO on multiple of our software stacks.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-6",
    "tier": "community",
    "url": "https://hn.algolia.com/api/v1/items/31258469",
    "excerpt": "I dropped Keycloak because its 2 GiB of RAM was too much for me to commit to SSO on my tiny VPS, so I just switched to static htpasswd management.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-7",
    "tier": "community",
    "url": "https://hn.algolia.com/api/v1/items/38964958",
    "excerpt": "CVE-2023-6927 Keycloak vulnerability allows bypassing redirect URI validation which can be used as a vector for stealing authorization codes, access tokens and be used to redirect victims to arbitrary hosts.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-8",
    "tier": "community",
    "url": "https://hn.algolia.com/api/v1/items/38964958",
    "excerpt": "Running as an enterprise Java app means you're getting a high/critical CVE every week for something you probably don't even use but which is bundled into something like Wildfly... needs to be lean.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-9",
    "tier": "community",
    "url": "https://hn.algolia.com/api/v1/items/38964958",
    "excerpt": "I'm using Casdoor... Keycloak was good but has too much legacy for 10+ years. Casdoor is pretty new and has become a good replacement for Keycloak for me with more functionalities.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-10",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=22871180",
    "excerpt": "We've been using Keycloak in production as a multi-tenant SSO solution for our service delivery. We've been incredibly impressed with the stability and performance and found it extremely effective.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-11",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=22871180",
    "excerpt": "I've run keycloak securing internet facing apps with ~1000 users for years. It's so stable, I usually forget it's even there.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-12",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=22871180",
    "excerpt": "I love keycloak but I was always disappointed it cannot be used as an LDAP server. As many open source products and SaaS support LDAP, it would have been perfect for an internal SSO.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-13",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=22871180",
    "excerpt": "I use various home made Ansible roles and I find the Keycloak API to be inconsistent... it's very hard to keep an idempotency with the actual state of the API.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-14",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=22871180",
    "excerpt": "After Okta rudely told us, a paying customer, to pay extra or leave, we decided to survey alternatives. Four years ago, we found Keycloak and never looked back. It's stable, customizable, well engineered.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-15",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=31258469",
    "excerpt": "I don't get it. Keycloak feels like some clunky 90s enterprise software... Had to run it on openshift and it was hell. It's not really made for containers, clustering is basically impossible.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-16",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=31258469",
    "excerpt": "I worked on a project which used Keycloak for authentication and SSO module between like 10+ java services with a custom UI and custom 2fa solution. I really liked it... I would recommend it to anyone.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-17",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=31258469",
    "excerpt": "My company used Keycloak for a long time... it works great, but it's hard to understand unless you already know oauth/oidc, and it is a huge binary... all those dependencies have become pretty off-putting.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-18",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=31258469",
    "excerpt": "My biggest issue in the version I was evaluating: Some service providers use 'email' as username. Keycloak doesn't make it easy to prohibit users from changing their own email, making it trivial to impersonate someone else.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-19",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=36384636",
    "excerpt": "My biggest problem with Keycloak is its configuration. It stores its configuration in the database. It means that I can't just configure it in some yaml configmaps. There's no easy supported way to test some changes before production.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-comm-20",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=36384636",
    "excerpt": "As a user of Keycloak on a production project, I'm a little sad there is currently no support for opaque tokens... We also experience a few front-end issues, like when a token expires, the browser tab goes back to the login page.",
    "fetchedAt": "2026-09-04T22:22:04.774Z"
  },
  {
    "id": "keycloak-probe-1",
    "tier": "probe",
    "url": "https://www.keycloak.org/llms.txt",
    "excerpt": "PROBE llms.txt: HTTP 404 at https://www.keycloak.org/llms.txt",
    "fetchedAt": "2026-09-16T01:42:36.618Z"
  },
  {
    "id": "keycloak-probe-2",
    "tier": "probe",
    "url": "https://www.keycloak.org/documentation.md",
    "excerpt": "PROBE docs-md: HTTP 404 at https://www.keycloak.org/documentation.md",
    "fetchedAt": "2026-09-16T01:42:36.618Z"
  },
  {
    "id": "keycloak-probe-3",
    "tier": "probe",
    "url": "https://www.keycloak.org/openapi.json",
    "excerpt": "PROBE openapi: all candidate paths 404 (https://www.keycloak.org/openapi.json, https://www.keycloak.org/swagger.json, https://www.keycloak.org/api/openapi.json, https://www.keycloak.org/.well-known/openapi.json)",
    "fetchedAt": "2026-09-16T01:42:36.618Z"
  }
]