JBoss.orgCommunity Documentation
Keycloak provides Authentication SPI, which allows to choose the AuthenticationProvider
for authenticating users.
AuthenticationProvider is the interface, which states how will be your usernames/passwords validated. You can choose from
the set of available AuthenticationProviders or you can even implement and plug your own AuthenticationProvider, which
will allow to provide your own way how will Keycloak validates users and their passwords.
Model
- This provider validates users and their passwords based on the Keycloak model. So it just delegates
to model implementation provided either by RDBMS or Mongo at this moment. This is default AuthenticationProvider,
which is configured for keycloak-admin
realm by default and it's also automatically configured for newly created realms.
External-model
- This provider also uses Keycloak model, but it uses different realm to validate your users against.
For example if you want to create new realm "foo" and you want all users of already existing realm "bar" that they are automatically
able to login into realm "foo" with their usernames and passwords, you can choose this provider.
Picketlink
- This provider delegates Authentication to Picketlink IDM
framework. Right now, Picketlink IDM in Keycloak is configured to always use LDAP based Identity store, which means that picketlink provider
allows you to authenticate your users against LDAP server. Note that you will first need to configure LDAP server as described
here . PicketlinkAuthenticationProvider
configured for the realm will automatically use LDAP configuration for this realm.
PicketlinkAuthenticationProvider
and authenticate users against LDAP but realm "keycloak-admin" will still use default ModelAuthenticationProvider
.
passwordUpdateSupported
.
This means that when user update password or his profile through Keycloak UI, this change will be propagated into AuthenticationProvider.
So for example password in LDAP will be updated if it's true
, but for read-only LDAP, you will likely switch it to false
.
It also means that newly registered users will be propagated to particular AuthenticationProvider too,
but note that each user is always bind just to one AuthenticationProvider.
Authentication
tab in admin console, which is under URL
http://localhost:8080/auth/admin/keycloak-admin/console/#/realms/YOUR_REALM/auth-settings
You need to implement interface AuthenticationProvider and add the name of your AuthenticationProviderFactory class into
META-INF/services/org.keycloak.authentication.AuthenticationProviderFactory
file inside your JAR with AuthenticationProvider. You also need to copy this JAR into
standalone/deployments/auth-server.war/WEB-INF/lib
. The best is to look at example and try it out.