Lion Cipher Lab
Set up single sign-on with Keycloak
- Identity & Access Management
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Almost every organization runs an identity provider -- the one system that holds who people are and hands other apps a trusted answer to 'is this really them?'. Okta, Microsoft Entra ID, Google Workspace, and Ping are the commercial versions; Keycloak is the free, open-source one you can actually run yourself and take apart. Reading about single sign-on gets you words; standing up a realm, a user, and a client gets you the mental model that sticks. In one sitting you go from 'SSO is magic' to 'SSO is a server I configured, issuing signed tokens to apps I registered.' That is the difference…
What you'll learn
- running an identity provider (Keycloak)
- OIDC realms, clients, and users
- walking an OIDC login flow end to end
- how SSO is issued and trusted
- identity-provider security settings
- client secrets and token lifetimes
- enabling multi-factor authentication
- why dev mode is not production
Steps in this lab
- What an identity provider, SSO, and OIDC actually are
- The four pieces inside Keycloak: realm, user, client, token
- Run Keycloak in dev mode with one Docker command
- Log into the admin console and create your realm
- Create a user who can log in
- Register a client (an app) and walk the OIDC login flow
- Lock it down: admin password, client secrets, token lifetimes, MFA
- Dev mode is a toy -- what production actually requires
- What you can now do that you could not before