{"id":2848,"date":"2020-01-30T10:02:23","date_gmt":"2020-01-30T10:02:23","guid":{"rendered":"https:\/\/login-master.com\/keycloak-as-identity-broker\/"},"modified":"2024-03-14T07:31:22","modified_gmt":"2024-03-14T07:31:22","slug":"keycloak-as-identity-broker","status":"publish","type":"post","link":"https:\/\/login-master.com\/en\/keycloak-as-identity-broker\/","title":{"rendered":"Keycloak as Identity Broker"},"content":{"rendered":"

[et_pb_section bb_built=”1″ _builder_version=”3.22″ next_background_color=”#000000″][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.0.47″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text admin_label=”Wie Keycloak als Identity Broker Unternehmen und Kunden die Onlinewelt vereinfacht” _builder_version=”4.23.4″ vertical_offset_tablet=”0″ horizontal_offset_tablet=”0″ hover_enabled=”0″ z_index_tablet=”0″ text_text_shadow_horizontal_length_tablet=”0px” text_text_shadow_vertical_length_tablet=”0px” text_text_shadow_blur_strength_tablet=”1px” link_text_shadow_horizontal_length_tablet=”0px” link_text_shadow_vertical_length_tablet=”0px” link_text_shadow_blur_strength_tablet=”1px” ul_text_shadow_horizontal_length_tablet=”0px” ul_text_shadow_vertical_length_tablet=”0px” ul_text_shadow_blur_strength_tablet=”1px” ol_text_shadow_horizontal_length_tablet=”0px” ol_text_shadow_vertical_length_tablet=”0px” ol_text_shadow_blur_strength_tablet=”1px” quote_text_shadow_horizontal_length_tablet=”0px” quote_text_shadow_vertical_length_tablet=”0px” quote_text_shadow_blur_strength_tablet=”1px” header_text_shadow_horizontal_length_tablet=”0px” header_text_shadow_vertical_length_tablet=”0px” header_text_shadow_blur_strength_tablet=”1px” header_2_text_shadow_horizontal_length_tablet=”0px” header_2_text_shadow_vertical_length_tablet=”0px” header_2_text_shadow_blur_strength_tablet=”1px” header_3_text_shadow_horizontal_length_tablet=”0px” header_3_text_shadow_vertical_length_tablet=”0px” header_3_text_shadow_blur_strength_tablet=”1px” header_4_text_shadow_horizontal_length_tablet=”0px” header_4_text_shadow_vertical_length_tablet=”0px” header_4_text_shadow_blur_strength_tablet=”1px” header_5_text_shadow_horizontal_length_tablet=”0px” header_5_text_shadow_vertical_length_tablet=”0px” header_5_text_shadow_blur_strength_tablet=”1px” header_6_text_shadow_horizontal_length_tablet=”0px” header_6_text_shadow_vertical_length_tablet=”0px” header_6_text_shadow_blur_strength_tablet=”1px” box_shadow_horizontal_tablet=”0px” box_shadow_vertical_tablet=”0px” box_shadow_blur_tablet=”40px” box_shadow_spread_tablet=”0px” sticky_enabled=”0″ text_line_height=”1.8em” header_line_height=”1.2em” background_pattern_color=”rgba(0,0,0,0.2)” background_mask_color=”#ffffff” text_text_shadow_horizontal_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_vertical_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_blur_strength=”text_text_shadow_style,%91object Object%93″ link_text_shadow_horizontal_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_vertical_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_blur_strength=”link_text_shadow_style,%91object Object%93″ ul_text_shadow_horizontal_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_vertical_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_blur_strength=”ul_text_shadow_style,%91object Object%93″ ol_text_shadow_horizontal_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_vertical_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_blur_strength=”ol_text_shadow_style,%91object Object%93″ quote_text_shadow_horizontal_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_vertical_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_blur_strength=”quote_text_shadow_style,%91object Object%93″ header_text_shadow_horizontal_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_vertical_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_blur_strength=”header_text_shadow_style,%91object Object%93″ header_2_text_shadow_horizontal_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_vertical_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_blur_strength=”header_2_text_shadow_style,%91object Object%93″ header_3_text_shadow_horizontal_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_vertical_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_blur_strength=”header_3_text_shadow_style,%91object Object%93″ header_4_text_shadow_horizontal_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_vertical_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_blur_strength=”header_4_text_shadow_style,%91object Object%93″ header_5_text_shadow_horizontal_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_vertical_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_blur_strength=”header_5_text_shadow_style,%91object Object%93″ header_6_text_shadow_horizontal_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_vertical_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_blur_strength=”header_6_text_shadow_style,%91object Object%93″]<\/p>\n

How Keycloak, as identity broker, simplifies the online world for companies and customers.<\/h2>\n

Keycloak in production as identity broker between different identity-managing systems.<\/strong><\/p>\n

Today, customers expect more convenience in e-commerce than a few years ago. Transactions via Internet portals are growing constantly and call for even more new, digital solutions.<\/strong><\/p>\n

Especially for a one-off purchase over the Internet, customers do not want to create another new account or assign a new password. Examples include the online purchase of a concert ticket or a travel ticket or to plan a shopping trip to the supermarket. With the\u00a0Kaufland app<\/a>, customers can decide whether they authenticate themselves with their customer account or via social networks. Even Deutsche Bank has recently started offering a login via the identity provider Verimi, if bank customers would like to log into their accounts. The use of an identity broker, which communicates with one or various identity providers, is worth it here in particular.<\/p>\n

How does the technical implementation with Keycloak look?
<\/strong>We at the Login Alliance ask Hasebullah Ansari, because he is an expert in this field. He works with Syntlogo GmbH and has worked with Keycloak for more than three years. He completed his last project with Deutsche Bahn.<\/p>\n

Login Alliance<\/strong>: \u201cMr Ansari, how does a company provide its applications as services in the Web via an identity broker?\u201d<\/p>\n

Hasebullah Ansari<\/strong>: \u201cThis is possible with Keycloak. The open source solution from Red Hat acts as an identity broker here between different identity providers. Keycloak references an account in a social media service (social networks like Facebook, Google, Twitter and the like), or alternatively a third party resource that supports OpenID Connect or SAML protocol.<\/p>\n

This can be a purchased or self-developed application, but also an LDAP directory service, an Active Directory or the Kerberos authentication service. It is then called a user federation. Here, we are talking about a federated identity, since the identity information always remains with the respective, original resource. This has the great advantage that a user doesn\u2019t have to create a new account for each, initial authentication.\u201d<\/p>\n

Login Alliance<\/strong>: \u201cWhat possibilities are there if a user wants to access several applications of a company without having to enter passwords multiple times?\u201d<\/p>\n

Hasebullah Ansari<\/strong>: \u201cThe following options lend themselves to this.<\/p>\n

    \n
  1. A Keycloak SSO implementation between different applications.<\/li>\n
  2. Identity brokering (via OICD (OpenID Connect), SAML or an account with a social network).<\/li>\n
  3. Or via a user federation (LDAP, Active Directory).\u201d<\/li>\n<\/ol>\n

    Login Alliance: <\/strong>\u201cIsn\u2019t a system overwhelmed when very many users want to use an app at the same time?\u201d<\/p>\n

    Hasebullah Ansari:<\/strong>\u00a0\u201cNaturally, in such a case, it is necessary to ensure high availability for the application and Keycloak (HA environment). You can use an HA cluster with multiple systems for this (master\/slave cluster). There are two possibilities for a cluster setup in Keycloak: firstly a standalone HA cluster mode, and secondly the domain clustered mode.\u201d<\/p>\n

    Our conclusion:\u00a0Modern systems use Keycloak as an identity broker in order to save end customers from having to assign passwords once again or to create a new account.\u00a0Existing accounts with Twitter, LinkedIn or Facebook can be used to make e-commerce services easy and convenient to use by means of Keycloak \u2013 an ideal solution!<\/strong><\/p>\n

    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section bb_built=”1″ _builder_version=”3.22″ custom_padding=”2px||2px|||” prev_background_color=”#000000″ next_background_color=”#000000″][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.0.47″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text admin_label=”Keycloak” _builder_version=”4.23.4″ vertical_offset_tablet=”0″ horizontal_offset_tablet=”0″ hover_enabled=”0″ z_index_tablet=”0″ text_text_shadow_horizontal_length_tablet=”0px” text_text_shadow_vertical_length_tablet=”0px” text_text_shadow_blur_strength_tablet=”1px” link_text_shadow_horizontal_length_tablet=”0px” link_text_shadow_vertical_length_tablet=”0px” link_text_shadow_blur_strength_tablet=”1px” ul_text_shadow_horizontal_length_tablet=”0px” ul_text_shadow_vertical_length_tablet=”0px” ul_text_shadow_blur_strength_tablet=”1px” ol_text_shadow_horizontal_length_tablet=”0px” ol_text_shadow_vertical_length_tablet=”0px” ol_text_shadow_blur_strength_tablet=”1px” quote_text_shadow_horizontal_length_tablet=”0px” quote_text_shadow_vertical_length_tablet=”0px” quote_text_shadow_blur_strength_tablet=”1px” header_text_shadow_horizontal_length_tablet=”0px” header_text_shadow_vertical_length_tablet=”0px” header_text_shadow_blur_strength_tablet=”1px” header_2_text_shadow_horizontal_length_tablet=”0px” header_2_text_shadow_vertical_length_tablet=”0px” header_2_text_shadow_blur_strength_tablet=”1px” header_3_text_shadow_horizontal_length_tablet=”0px” header_3_text_shadow_vertical_length_tablet=”0px” header_3_text_shadow_blur_strength_tablet=”1px” header_4_text_shadow_horizontal_length_tablet=”0px” header_4_text_shadow_vertical_length_tablet=”0px” header_4_text_shadow_blur_strength_tablet=”1px” header_5_text_shadow_horizontal_length_tablet=”0px” header_5_text_shadow_vertical_length_tablet=”0px” header_5_text_shadow_blur_strength_tablet=”1px” header_6_text_shadow_horizontal_length_tablet=”0px” header_6_text_shadow_vertical_length_tablet=”0px” header_6_text_shadow_blur_strength_tablet=”1px” box_shadow_horizontal_tablet=”0px” box_shadow_vertical_tablet=”0px” box_shadow_blur_tablet=”40px” box_shadow_spread_tablet=”0px” text_line_height=”1.8em” sticky_enabled=”0″]<\/p>\n

    \n

    Keycloak<\/h2>\n

    Keycloak is an open source solution for identity and access management. It focuses on the protection of modern applications and services. With Keycloak you can safely implement the authentification to applications and services with less or no code.<\/strong><\/p>\n

    Keycloak is functionally very extensive, user-friendly, and has an easy to use user interface, and it is multi-client capable.<\/strong><\/p>\n

    Learn more<\/span><\/a><\/div>\n<\/div>\n

    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section bb_built=”1″ _builder_version=”3.22″ prev_background_color=”#000000″ next_background_color=”#000000″][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.0.47″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_blurb title=”What is an identity broker?” use_icon=”on” font_icon=”&#x70;||divi||400″ icon_color=”#5a5a5a” content_max_width=”100%” _builder_version=”4.23.4″ header_font_size=”30px” vertical_offset_tablet=”0″ horizontal_offset_tablet=”0″ z_index_tablet=”0″ header_text_shadow_horizontal_length_tablet=”0px” header_text_shadow_vertical_length_tablet=”0px” header_text_shadow_blur_strength_tablet=”1px” body_text_shadow_horizontal_length_tablet=”0px” body_text_shadow_vertical_length_tablet=”0px” body_text_shadow_blur_strength_tablet=”1px” body_link_text_shadow_horizontal_length_tablet=”0px” body_link_text_shadow_vertical_length_tablet=”0px” body_link_text_shadow_blur_strength_tablet=”1px” body_ul_text_shadow_horizontal_length_tablet=”0px” body_ul_text_shadow_vertical_length_tablet=”0px” body_ul_text_shadow_blur_strength_tablet=”1px” body_ol_text_shadow_horizontal_length_tablet=”0px” body_ol_text_shadow_vertical_length_tablet=”0px” body_ol_text_shadow_blur_strength_tablet=”1px” body_quote_text_shadow_horizontal_length_tablet=”0px” body_quote_text_shadow_vertical_length_tablet=”0px” body_quote_text_shadow_blur_strength_tablet=”1px” box_shadow_horizontal_tablet=”0px” box_shadow_vertical_tablet=”0px” box_shadow_blur_tablet=”40px” box_shadow_spread_tablet=”0px” box_shadow_horizontal_image_tablet=”0px” box_shadow_vertical_image_tablet=”0px” box_shadow_blur_image_tablet=”40px” box_shadow_spread_image_tablet=”0px” text_shadow_horizontal_length_tablet=”0px” text_shadow_vertical_length_tablet=”0px” text_shadow_blur_strength_tablet=”1px” background_pattern_color=”rgba(0,0,0,0.2)” background_mask_color=”#ffffff” image_icon_width_tablet=”101px” border_width_all_image_tablet=”25″ text_shadow_horizontal_length=”text_shadow_style,%91object Object%93″ text_shadow_vertical_length=”text_shadow_style,%91object Object%93″ text_shadow_blur_strength=”text_shadow_style,%91object Object%93″ header_level=”h3″ header_text_shadow_horizontal_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_vertical_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_blur_strength=”header_text_shadow_style,%91object Object%93″ body_text_shadow_horizontal_length=”body_text_shadow_style,%91object Object%93″ body_text_shadow_vertical_length=”body_text_shadow_style,%91object Object%93″ body_text_shadow_blur_strength=”body_text_shadow_style,%91object Object%93″ body_link_text_shadow_horizontal_length=”body_link_text_shadow_style,%91object Object%93″ body_link_text_shadow_vertical_length=”body_link_text_shadow_style,%91object Object%93″ body_link_text_shadow_blur_strength=”body_link_text_shadow_style,%91object Object%93″ body_ul_text_shadow_horizontal_length=”body_ul_text_shadow_style,%91object Object%93″ body_ul_text_shadow_vertical_length=”body_ul_text_shadow_style,%91object Object%93″ body_ul_text_shadow_blur_strength=”body_ul_text_shadow_style,%91object Object%93″ body_ol_text_shadow_horizontal_length=”body_ol_text_shadow_style,%91object Object%93″ body_ol_text_shadow_vertical_length=”body_ol_text_shadow_style,%91object Object%93″ body_ol_text_shadow_blur_strength=”body_ol_text_shadow_style,%91object Object%93″ body_quote_text_shadow_horizontal_length=”body_quote_text_shadow_style,%91object Object%93″ body_quote_text_shadow_vertical_length=”body_quote_text_shadow_style,%91object Object%93″ body_quote_text_shadow_blur_strength=”body_quote_text_shadow_style,%91object Object%93″ icon_placement=”left” \/][et_pb_text admin_label=”Was ist ein Identity Broker?” _builder_version=”4.23.4″ vertical_offset_tablet=”0″ horizontal_offset_tablet=”0″ hover_enabled=”0″ z_index_tablet=”0″ text_text_shadow_horizontal_length_tablet=”0px” text_text_shadow_vertical_length_tablet=”0px” text_text_shadow_blur_strength_tablet=”1px” link_text_shadow_horizontal_length_tablet=”0px” link_text_shadow_vertical_length_tablet=”0px” link_text_shadow_blur_strength_tablet=”1px” ul_text_shadow_horizontal_length_tablet=”0px” ul_text_shadow_vertical_length_tablet=”0px” ul_text_shadow_blur_strength_tablet=”1px” ol_text_shadow_horizontal_length_tablet=”0px” ol_text_shadow_vertical_length_tablet=”0px” ol_text_shadow_blur_strength_tablet=”1px” quote_text_shadow_horizontal_length_tablet=”0px” quote_text_shadow_vertical_length_tablet=”0px” quote_text_shadow_blur_strength_tablet=”1px” header_text_shadow_horizontal_length_tablet=”0px” header_text_shadow_vertical_length_tablet=”0px” header_text_shadow_blur_strength_tablet=”1px” header_2_text_shadow_horizontal_length_tablet=”0px” header_2_text_shadow_vertical_length_tablet=”0px” header_2_text_shadow_blur_strength_tablet=”1px” header_3_text_shadow_horizontal_length_tablet=”0px” header_3_text_shadow_vertical_length_tablet=”0px” header_3_text_shadow_blur_strength_tablet=”1px” header_4_text_shadow_horizontal_length_tablet=”0px” header_4_text_shadow_vertical_length_tablet=”0px” header_4_text_shadow_blur_strength_tablet=”1px” header_5_text_shadow_horizontal_length_tablet=”0px” header_5_text_shadow_vertical_length_tablet=”0px” header_5_text_shadow_blur_strength_tablet=”1px” header_6_text_shadow_horizontal_length_tablet=”0px” header_6_text_shadow_vertical_length_tablet=”0px” header_6_text_shadow_blur_strength_tablet=”1px” box_shadow_horizontal_tablet=”0px” box_shadow_vertical_tablet=”0px” box_shadow_blur_tablet=”40px” box_shadow_spread_tablet=”0px” text_line_height=”1.8em” sticky_enabled=”0″]<\/p>\n

    An identity broker is an intermediate service that connects multiple service providers with different identity providers. As an intermediary service, an identity broker is responsible for establishing a trust relationship with an external identity provider in order to use its identities to access internal services that are offered by service providers.<\/p>\n

    From the user\u2019s perspective, an identity broker provides a user-orientated and centralised way to manage identities across different security domains or areas.<\/strong> It links an existing account with one or more identities of different identity providers, or even creates a new account on the basis of the identity information that it obtains from them.<\/p>\n

    An identity provider is usually based on a specific protocol. It is used for the authentication and communication of authentication and authorisation information to its users.<\/strong> It can be a social provider such as Facebook, Google or Twitter. It can be a business partner whose users would like to access your services. Or it is a cloud-based identity service that you would like to integrate.<\/p>\n

    Identity providers are usually based on the following protocols:<\/strong><\/p>\n