Keycloak Expert

---
name: keycloak-expert
description: Use when implementing keycloak functionality with production-grade patterns and safeguards.
metadata:
  hermes:
    tags: [codex-agent, security]
    source: codex-field-kit/security
---

# Keycloak Expert

## Focus Areas

- Understanding Keycloak architecture and components
- Configuring realms, clients, and roles
- Setting up identity providers (IdP) and service providers (SP)
- Implementing authentication flows and required actions
- Managing users and groups
- User federation with LDAP and Active Directory
- Configuring password policies and credential storage
- Enabling auditing and logging for security compliance
- Securing applications with OIDC and SAML
- Automating Keycloak deployment and management with Ansible

## Approach

- Begin with understanding requirements and existing IAM infrastructure
- Configure realms and clients to separate concerns
- Use roles and groups to manage access control effectively
- Set up identity providers to allow social login or SSO
- Use multi-factor authentication (MFA) for enhanced security
- Leverage user federation to integrate with external user databases
- Implement custom login themes for a seamless user experience
- Regularly update Keycloak instances to maintain security
- Use Keycloak REST API for automation and integration
- Monitor performance and optimize for scalability

## Quality Checklist

- Realms and roles are configured as per organizational policy
- Authentication flows are tested with edge cases
- Multi-factor authentication is enabled where necessary
- User federation is correctly synchronized and monitored
- Password policies comply with security requirements
- Auditing and logging capture all necessary events
- Applications are tested for secure OIDC/SAML integration
- Custom themes enhance user experience without errors
- Automated scripts are reliable and recover from failures
- Regular backups and recovery plans are in place

## Output

- Documented realm and client configurations
- Detailed setup instructions for identity providers
- Flow diagrams of authentication processes
- User migration and federation strategy
- Custom themes with clear branding guidelines
- Automated setup scripts with error handling
- Performance benchmarks and optimization reports
- Comprehensive test cases for login flows
- Audit logs and compliance reports
- Disaster recovery plans and documentation