KeycloakCon Europe 2026
2026-03-23
Amsterdam, Netherlands
as the organisers put it
KeycloakCon Europe 2026 has officially wrapped! Thank you to all the attendees who joined us. Watch keynotes and all breakout sessions on the CNCF YouTube Channel. Review session slides from speakers…
who it's for
identity engineers, Keycloak operators, platform engineers, security engineers, devops engineers, software architects
topics
SPIFFE client authentication; SPIRE agent SVIDs and automation; token exchange with audience parameter; MCP authorization for agentic AI; Model Context Protocol integration; OpenID4VCI wallets (SD-JWT and mDoc); Keycloak token scope and client-scope mappers; transaction token flow with TXN header; X.509 / CAC as MFA and client authenticators; airgap deployment with Zarf single-file bundles
| title | author | length |
|---|---|---|
| Welcome + Opening Remarks | Alexander Schwartz | 07m |
Keycloak is an Apache 2 open source IAM that reaches 33,000 GitHub stars and becomes a CNCF incubating project since April 20 2023. It issues and verifies… | ||
| Advancing Machine to Machine Workflows with the SPIFFE Identity Provider | Andrew Block, Maia Iyer | 30m |
Shows how Keycloak v26.4.0 uses federated client authentication to accept workload identities issued by SPIFFE/SPIRE, using a SPIRE agent + server, Toria for… | ||
| The Keycloak-Token-Configuration Mistake, 90% of All Developers Do (and How To Avoid It) | Niko Köbler | 29m |
Keycloak by default stuffs access tokens with profile claims, realm and client roles and many audiences, causing oversized tokens and GDPR risk; demos use the… | ||
| Keynote: Modernizing Railway IT Architecture: Secure-by-D... | Bernhard Denner | 05m |
Hitachi Rail rebuilds on-premise control systems with secure-by-design principles, replacing LDAP/AD for IT tooling with Keycloak as central OIDC broker to… | ||
| Model Context Protocol(MCP) Authorization for Enterprise Use Case With Keycloak | Yutaka Obuchi | 25m |
Proposal SEP-646 merged Oct 31 adds enterprise-managed MCP authorization so agentic AI uses an identity assertion (ID-JWT / ID jot) instead of per-resource… | ||
| Bridging the Gap Between Human and Workload Identity: SPIFFE Support in Keycloak | Arndt Schwenkschuster, Dmitry Telegin | 25m |
Keycloak 26.4 adds SPIFFE client authentication so workloads can use runtime SPIFFE identities instead of client secrets; a plugin implements a… | ||
| Lightning Talk: Effortlessly Integrating Keycloak Authentication To Your MCP Servers | Lin Sun | 11m |
Shows adding Keycloak OpenID Connect auth the hard way by editing a Python MCP server, rebuilding and redeploying, then demonstrates an alternative: place an… | ||
| Lightning Talk: Keycloak and EUDI-Wallet: A Match Made in Heaven? | Dominik Schlosser | 11m |
Implemented a working Keycloak prototype that issues and verifies EU Digital Identity Wallet credentials using OpenID4VCI and supports SD-JWT and mDoc formats… | ||
| ⚡Lightning Talk: Airgap-native Identity Management: Lessons From Keycloak in DoD Deployments | Sebastian Łaskawiec, Michal Szynkiewicz | 09m |
Zarf creates a Zarf single-file ZST bundle from container images, Helm charts and a zarf.yaml manifest, Zarf init injects an internal registry (via configmap… | ||
| Closing Remarks | Yoshiyuki Tabata | 04m |
Conference closes with thanks to sponsors and details for follow up and logistics: diamond sponsor Styra and startup sponsor Keymate receive explicit… | ||
| nothing matches | ||