KeyConf26

Given the upcoming EIDAS regulation, Keycloak poses itself as a strong solution to issue fully compliant verifiable credentials. On this workshop, you will be guided on what needs to be done to have a reliable Keycloak issuer. An overview of the issuance spec will be given and all the background for you to understand the state of the art on this matter.

Applications and AI agents increasingly need to interact across independent trust domains while maintaining the security and integrity of the original user identity. This session explores how Keycloak solves this principal propagation challenge using Token Exchange (RFC 8693) and the JWT Authorization Grant (RFC 7523), guided by two emerging specifications: OAuth 2.0 Identity and Authorization Chaining Across Domains and the Identity Assertion Authorization Grant. We will examine how Keycloak handles cross-domain context propagation, validating external assertions and issuing target-scoped access tokens. Attendees will leave with practical patterns for building secure, asynchronous integration chains that strictly preserve user context end-to-end, without relying on static API keys or over-privileged service accounts.

Keycloak has evolved over the years, and is challenging to balance simplicity, functional completeness and security by default. Join this interactive group exercise and work with users, maintainers and contributors to identify where different goals conflict in Keycloak today. As a group, we generate solution ideas on how Keycloak can improve and prioritize them, so they can make their way in the Keycloak product roadmap.

Keycloak's default token configuration is generous: roles, claims, metadata – everything lands in the Access Token right away. That's convenient and gets you started fast. But over time, tokens grow silently. They carry information that recipients don't need, shouldn't see, or that simply doesn't belong there. What starts as a comfort feature becomes a liability – bloated HTTP headers, tokens that leak internal structure to third parties, and a configuration that's hard to reconcile with GDPR's data minimization principle. Token hygiene means treating token contents as a conscious design decision, not as a default you never revisit. In this session, I'll walk through Keycloak's client scope and mapper configuration to show which claims actually belong in which token – and which don't. We'll look at practical strategies for keeping Access Tokens lean, including Token Exchange as a tool to issue purpose-built, audience-specific tokens for downstream services instead of forwarding one overloaded token everywhere. You'll leave with a clear understanding of how to configure Keycloak for minimal, GDPR-friendly tokens – where each recipient gets exactly what it needs, and nothing more.

For years, Keycloak has been the "Enterprise Identity Provider", secure but often disconnected from the modern frontend developer's workflow. While new libraries promise "easy auth" by running inside your app, they often sacrifice the battle-hardened security of a standalone IAM. I will demonstrate how we are bridging this gap. This talk dives into the new OAuth 2.1 Native App Flow and Headless UI patterns that allow developers to build pixel-perfect, framework-agnostic authentication without ever touching a raw password or a clunky redirect.