High-level API Security
summary
Keycloak adds client policies so new FAPI-style security profiles plug in as modules (no core code change) and map to clients, solving the pain of 40+ configuration points and enabling one client to carry multiple profiles; a policy can apply to hundreds of clients. Built a conformance test harness using Toka containers, published results in the repo, and recent Keycloak releases pass major OpenID Foundation tests. Also demonstrates token binding via mutual TLS (certificate-hash stored with the access token) enforced at the API gateway.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 2:05Agenda
- 2:23What is API
- 3:38Authorization
- 7:24Happy
- 8:37Happy Overview
- 10:37API Requirements
- 11:14API Security
- 12:48Security Enhancement
- 13:28Access Token
- 16:20Conformance Test
- 17:49API Security Profile
- 19:02Summary
- 21:51Introduction of Client Policies
- 25:55Security Profiles
- 26:45Conformance Tests
- 29:43Community
related talks
27mDesigning an Agentic AI-Ready Secure Authentication and Authorization Platform
27mA high-security API management infrastructure using Apache Camel
06mStandardizing Authentication Flows in Keycloak Environments – Efficient Authorization S...
14mKeycloak Journey - Evolution of Business and Community
42mConfirming Safety of IAM Specifications and their OSS Implementations: Keycloak as a Case Study
07mWelcome + Opening Remarks
54mHow to secure your Spring apps with Keycloak
26mKeycloak Introduction and Demo