# Single sign-on with Keycloak

> Single sign-on with Keycloak: identity and access management for B2B environments — OAuth 2.1, OIDC, realm design and operation in your infrastructure.

Quelle: https://kontrollfeld.de/en/services/sso-keycloak/
Sprache: en

---
Central identity instead of password sprawl: we design and operate Keycloak instances for B2B environments — from realm design through federation to connecting your applications.

## When central sign-in is worth it

The usual trigger is not a security incident but someone leaving: access has to be revoked in five places one at a time. Whoever forgets the sixth finds out at the next audit. The same applies in reverse when someone joins, and for external contractors and customers using a portal.

Past three applications with their own user management the point is usually reached. A single application with a handful of internal users does not need Keycloak — there the operational overhead outweighs the gain, and we say so.

## Decisions that come up

**How many realms.** One realm per tenant separates cleanly but multiplies maintenance; one realm with groups is leaner but demands discipline about permissions. The decision can only be corrected later by migrating — which is why it comes first.

**Where the truth about users lives.** Does Active Directory stay the leading source with Keycloak federating, or do the accounts move across? Both are workable, but it must not be left open.

**Roles, groups or attributes.** Roles describe what someone may do; groups describe who someone is. Mix them and you get a model nobody can explain two years later.

**Who operates it.** Keycloak upgrades are not a side task: defaults change between major versions, and occasionally the data model does too. Whoever runs the instance has to plan for that cycle.

## What you get

- Realm and client architecture, role and group model
- OIDC/SAML integration of existing applications
- User federation (LDAP/AD) and identity brokering
- Hardening, an upgrade path and operation
- Documentation of the permission model, so it stays auditable

## How you know it holds

Someone leaving takes effect in one place and immediately. A new application gets connected instead of being built with its own user management. And the question of who was allowed to access what, and when, can be answered from the log rather than from memory.