KeycloakCon Japan 2026
as the organisers put it
KeycloakCon Japan 2026 has officially wrapped! Thank you to all the attendees who joined us. Watch keynotes and all breakout sessions on the CNCF YouTube Channel. Review session slides from speakers…
who it's for
Keycloak operators, identity architects, platform engineers, security engineers, site reliability engineers, cloud native engineers, devops engineers
topics
Keycloak OIDC issuer integrations; Sigstore Fulcio and cosign; ID-JAG token exchange; SPIFFE/SPIRE workload identity; DPoP under FAPI 2.0; Kubernetes service-to-service auth; Wasm Istio policy enforcement; UMA ticket grant flow; per-client signing key rotation; passkeys with recovery codes; SCIM provisioning preview; stateless multi-cluster V2
| title | author | length |
|---|---|---|
| Welcome + Opening Remarks | Alexander Schwartz | 09m |
Brief orientation to Keycloak as a self-hosted identity platform: it runs from a single container to start and scales to millions of users in production… | ||
| Keycloak + Sigstore: Binding Human Identity To Artifact Signatures | Oshi Gupta, Sagar Utekar | 20m |
Wires Keycloak as OIDC provider into Sigstore so Fulcio issues short‑lived certs bound to Keycloak identities, with cosign producing and verifying signatures… | ||
| Simple Control: Managing Multi-Domain MCP Access Via Keycloak IdP With ID-JAG | Yutaka Obuchi | 27m |
Centralized IdP issues signed identity vouchers (ID-JAG) so MCP clients present a Keycloak-backed JWT to MCP authorization servers, moving authorization out of… | ||
| You Don't Need a New Identity Platform for the AI Era | Y. Lin | 04m |
An implementation for a UK and a Philippine tier-one bank proves agentic identity without a new platform, using Keycloak token delegation and exchange… | ||
| OSS Contribution Empowers AI in Social Infrastructure and… | T. Norimatsu | 06m |
Claim: contributing and maintaining OSS is essential for deploying AI in transportation, energy and mobility; Hitachi reports active contributions to Keycloak… | ||
| MCPIdentity: Keyless MCP Agent Authentication Patterns on Kubernetes With Keycloak… | M. Dayıoğlu | 27m |
Demonstrates a concrete Keycloak 26.6 + SPIRE pattern that removes static keys for MCP agents: SPIRE issues in‑memory JWT‑SVIDs, agents generate ephemeral… | ||
| Using Keycloak Authorization Service for Kubernetes Service-to-Service… | H. Özkan | 16m |
Shows a working WebAssembly Wasm plugin that makes Istio act as a Policy Enforcement Point and calls Keycloak as a Policy Decision Point, using Istio Ambient… | ||
| Surviving Certificate Expiry in Enterprise Keycloak: Per-Client Key… | H. Wada | 09m |
Keycloak generates realm signing certificates with a 10-year hardcoded expiry and many late-2010s installs face imminent expiry; enterprise tenants run… | ||
| Securing Non-Human Identities: A Defense-in-Depth Blueprint for AI Agents | Tatsuya Yano | 25m |
At LINE/Yahoo! JAPAN scale the system serves tens of millions of users across more than 10,000 Kubernetes nodes and fixes the resurrected confused deputy by… | ||
| Keynote: Closing Remarks | Yoshiyuki Tabata | 02m |
Event closes with thanks to speakers and explicit takeaways: sessions cover AI agent, MCP, Kubernetes, authorization, software supply chain security, and cloud… | ||
| What Is New and Coming for Managing Cloud Native Identities in… | A. Schwartz | 12m |
Keycloak now ships concrete features: Passkeys with recovery codes and credential recovery in 26.6, SCIM preview (26.7) for standardized user/group… | ||
| nothing matches | ||