Identities and Authentication for Your Agents With Keycloak
summary
Keycloak acts as a token broker for agent identities, issuing short‑lived OAuth tokens (minutes) from workload identities such as SPIFFE or Kubernetes service account tokens, linking human and agent via token exchange (RFC 8693) with an act claim that limits audience and scopes, and supporting just‑in‑time cross‑org assertions via the IDJAR flow. Experimental features include dynamic client registration (CIMD), ALCSN PDP integration, and resource‑indicator support planned next release; demos show VS Code and Cloud Code successfully auto‑registering and receiving mcp_tools tokens.
AI-written summary · about
chapters (7)
- 0:00Keycloak and AI agents intro
- 3:31Keycloak AI capabilities
- 7:48Token exchange auth
- 10:16MCP authorization
- 14:12Demo MCP AI tool
- 21:50Keycloak milestones
- 24:16Q&A
related talks
25mWho Let the Agents Out? Securing AI Workflows the Right Way
27mMCPIdentity: Keyless MCP Agent Authentication Patterns on Kubernetes With Keycloak…
27mGive Agents the Right Keys - Identity Assertion for Enterprise APIs
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
01h 22mIdentity for AI Agents
04mYou Don't Need a New Identity Platform for the AI Era
12mWhat Is New and Coming for Managing Cloud Native Identities in…
32mAI Agents with Keycloak in MCP