# Server Administration Guide > Keycloak is a single sign on solution for web apps and RESTful web services. The goal of Keycloak is to make security simple so that it is easy for application developers to secure the apps and services they have deployed in their organization. Security features that developers normally have to writ ## Sections - [Keycloak features and concepts](md/keycloak-features-and-concepts.md): Keycloak is a single sign on solution for web apps and RESTful web services. The goal of Keycloak is to make security si - [Features](md/features.md): Keycloak provides the following features: - [Basic Keycloak operations](md/basic-keycloak-operations.md): Keycloak is a separate server that you manage on your network. Applications are configured to point to and be secured by - [Core concepts and terms](md/core-concepts-and-terms.md): Consider these core concepts and terms before attempting to use Keycloak to secure your web applications and REST servic - [Creating the first administrator](md/creating-first-admin_server_administration_guide.md): After installing Keycloak, you need an administrator account that can act as a super admin with full permissions to mana - [Creating the account on the local host](md/creating-the-account-on-the-local-host.md): If your server is accessible from localhost, perform these steps. - [Creating the account remotely](md/creating-the-account-remotely.md): If you cannot access the server from a localhost address or just want to start Keycloak from the command line, use the K - [Configuring realms](md/_configuring-realms.md): Once you have an administrative account for the Admin Console, you can configure realms. A realm is a space where you ma - [Using the Admin Console](md/using-the-admin-console.md): You configure realms and perform most administrative tasks in the Keycloak Admin Console. - [The master realm](md/the-master-realm.md): In the Admin Console, two types of realms exist: - [Creating a realm](md/proc-creating-a-realm_server_administration_guide.md): You create a realm to provide a management space where you can create users and give them permissions to use application - [Configuring SSL for a realm](md/_ssl_modes.md): Each realm has an associated SSL Mode, which defines the SSL/HTTPS requirements for interacting with the realm. Browsers - [Configuring email for a realm](md/_email.md): Keycloak sends emails to users to verify their email addresses, when they forget their passwords, or when an administrat - [Configuring themes](md/_themes.md): For a given realm, you can change the appearance of any UI in Keycloak by using themes. - [Enabling internationalization](md/enabling-internationalization.md): Every UI screen is internationalized in Keycloak. The default language is English, but you can choose which locales you - [Controlling login options](md/controlling-login-options.md): Keycloak includes several built-in login page features. - [Configuring realm keys](md/realm_keys.md): The authentication protocols that are used by Keycloak require cryptographic signatures and sometimes encryption. Keyclo - [Using external storage](md/_user-storage-federation.md): Organizations can have databases containing information, passwords, and other credentials. Typically, you cannot migrate - [Adding a provider](md/adding-a-provider.md): To add a storage provider, perform the following procedure: - [Dealing with provider failures](md/dealing-with-provider-failures.md): If a User Storage Provider fails, you may not be able to log in and view users in the Admin Console. Keycloak does not d - [Lightweight Directory Access Protocol (LDAP) and Active Directory](md/_ldap.md): Keycloak includes an LDAP/AD provider. You can federate multiple different LDAP servers in one Keycloak realm and map LD - [SSSD and FreeIPA Identity Management integration](md/_sssd.md): Keycloak includes the System Security Services Daemon (SSSD) plugin. SSSD is part of the Fedora and Red Hat Enterprise L - [Custom providers](md/custom-providers.md): Keycloak does have a Service Provider Interface (SPI) for User Storage Federation to develop custom providers. You can f - [Managing users](md/assembly-managing-users_server_administration_guide.md): From the Admin Console, you have a wide range of actions you can perform to manage users. - [Creating users](md/proc-creating-user_server_administration_guide.md): You create users in the realm where you intend to have applications needed by those users. Avoid creating users in the m - [Managing user attributes](md/user-profile.md): In Keycloak a user is associated with a set of attributes. These attributes are used to better describe and identify use - [Defining user credentials](md/ref-user-credentials_server_administration_guide.md): You can manage credentials of a user in the Credentials tab. - [Allowing users to self-register](md/con-user-registration_server_administration_guide.md): You can use Keycloak as a third-party authorization server to manage application users, including users who self-registe - [Defining actions required at login](md/con-required-actions_server_administration_guide.md): You can set the actions that a user must perform at the first login. These actions are required after the user provides - [Application initiated actions](md/con-aia_server_administration_guide.md): Application initiated actions (AIA) allow client applications to request a user to perform an action on the Keycloak sid - [Searching for a user](md/proc-searching-user_server_administration_guide.md): Search for a user to view detailed information about the user, such as the user’s groups and roles. - [Deleting a user](md/proc-deleting-user_server_administration_guide.md): You can delete a user, who no longer needs access to applications. If a user is deleted, the user profile and data is al - [Enabling account deletion by users](md/proc-allow-user-to-delete-account_server_administration_guide.md): End users and applications can delete their accounts in the Account Console if you enable this capability in the Admin C - [Impersonating a user](md/con-user-impersonation_server_administration_guide.md): An administrator with the appropriate permissions can impersonate a user. For example, if a user experiences a bug in an - [Enabling reCAPTCHA](md/proc-enabling-recaptcha_server_administration_guide.md): To safeguard registration against bots, Keycloak has integration with Google reCAPTCHA (see Setting up Google reCAPTCHA) - [Personal data collected by Keycloak](md/ref-personal-data-collected_server_administration_guide.md): By default, Keycloak collects the following data: - [Managing user sessions](md/managing-user-sessions.md): When users log into realms, Keycloak maintains a user session for each user and remembers each client visited by the use - [Administering sessions](md/administering-sessions.md): To see a top-level view of the active clients and sessions in Keycloak, click Sessions from the menu. - [Revoking active sessions](md/_revocation-policy.md): If your system is compromised, you can revoke all active sessions and access tokens. - [Session and token timeouts](md/_timeouts.md): Keycloak includes control of the session, cookie, and token timeouts through the Sessions and Tokens tabs in the Realm s - [Offline access](md/_offline-access.md): During offline access logins, the client application requests an offline token instead of a refresh token. The client ap - [Transient sessions](md/_transient-session.md): You can conduct transient sessions in Keycloak. When using transient sessions, Keycloak does not create a user session a - [Assigning permissions using roles and groups](md/assigning-permissions-using-roles-and-groups.md): Roles and groups have a similar purpose, which is to give users access and permissions to use applications. Groups are a - [Creating a realm role](md/proc-creating-realm-roles_server_administration_guide.md): Realm-level roles are a namespace for defining your roles. To see the list of roles, click Realm Roles in the menu. - [Client roles](md/con-client-roles_server_administration_guide.md): Client roles are namespaces dedicated to clients. Each client gets its own namespace. Client roles are managed under the - [Converting a role to a composite role](md/_composite-roles.md): Any realm or client level role can become a composite role. A composite role is a role that has one or more additional r - [Assigning role mappings](md/proc-assigning-role-mappings_server_administration_guide.md): You can assign role mappings to a user through the Role Mappings tab for that user. - [Using default roles](md/_default_roles.md): Use default roles to automatically assign user role mappings when a user is created or imported through Identity Brokeri - [Role scope mappings](md/_role_scope_mappings.md): On creation of an OIDC access token or SAML assertion, the user role mappings become claims within the token or assertio - [Groups](md/proc-managing-groups_server_administration_guide.md): Groups in Keycloak manage a common set of attributes and role mappings for each user. Users can be members of any number - [Configuring authentication](md/configuring-authentication_server_administration_guide.md): This chapter covers several authentication topics. These topics include: - [Password policies](md/_password-policies.md): When Keycloak creates a realm, it does not associate password policies with the realm. You can set a simple password wit - [One Time Password (OTP) policies](md/one-time-password-otp-policies.md): Keycloak has several policies for setting up a FreeOTP or Google Authenticator One-Time Password generator. - [Authentication flows](md/_authentication-flows.md): An authentication flow is a container of authentications, screens, and actions, during log in, registration, and other K - [User session limits](md/_user_session_limits.md): Limits on the number of session that a user can have can be configured. Sessions can be limited per realm or per client. - [Script Authenticator](md/script-authenticator.md): Ability to upload scripts through the Admin Console and REST endpoints is deprecated. - [Kerberos](md/_kerberos.md): Keycloak supports login with a Kerberos ticket through the Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) pr - [X.509 client certificate user authentication](md/_x509.md): Keycloak supports logging in with an X.509 client certificate if you have configured the server to use mutual SSL authen - [W3C Web Authentication (WebAuthn)](md/webauthn_server_administration_guide.md): Keycloak provides support for W3C Web Authentication (WebAuthn). Keycloak works as a WebAuthn’s Relying Party (RP). - [Passkeys](md/passkeys_server_administration_guide.md): Keycloak provides support for Passkeys. Keycloak works as a Passkeys Relying Party (RP). - [Conditions in conditional flows](md/conditions-in-conditional-flows.md): As was mentioned in Execution requirements, Condition executions can be only contained in Conditional subflow. If all Co - [Authentication sessions](md/_authentication-sessions.md): When a login page is opened for the first time in a web browser, Keycloak creates an object called authentication sessio - [Integrating identity providers](md/_identity_broker.md): An Identity Broker is an intermediary service connecting service providers with identity providers. The identity broker - [Brokering overview](md/_identity_broker_overview.md): When using Keycloak as an identity broker, Keycloak does not force users to provide their credentials to authenticate in - [Default Identity Provider](md/default_identity_provider.md): Keycloak can redirect to an identity provider rather than displaying the login form. To enable this redirection: - [General configuration](md/_general-idp-config.md): The foundations of the identity broker configuration are identity providers (IDPs). Keycloak creates identity providers - [Social Identity Providers](md/social-identity-providers.md): A social identity provider can delegate authentication to a trusted, respected social media account. Keycloak includes s - [OpenID Connect v1.0 identity providers](md/_identity_broker_oidc.md): Keycloak brokers identity providers based on the OpenID Connect protocol. These identity providers (IDPs) must support t - [OAuth v2 identity providers](md/_identity_broker_oauth.md): Keycloak brokers identity providers based on the OAuth v2 protocol. These identity providers (IDPs) must support the Aut - [SAML v2.0 Identity Providers](md/saml-v2-0-identity-providers.md): Keycloak can broker identity providers based on the SAML v2.0 protocol. - [SPIFFE identity providers](md/_identity_broker_spiffe.md): SPIFFE is Preview and is not fully supported. This feature is disabled by default. - [Kubernetes identity providers](md/_identity_broker_kubernetes.md): A Kubernetes identity provider supports authenticating clients with Kubernetes service account tokens. - [Client-suggested Identity Provider](md/_client_suggested_idp.md): OIDC applications can bypass the Keycloak login page by hinting at the identity provider they want to use. You can enabl - [Mapping claims and assertions](md/_mappers.md): You can import the SAML and OpenID Connect metadata, provided by the external IDP you are authenticating with, into the - [Available user session data](md/available-user-session-data.md): After a user login from an external IDP, Keycloak stores user session note data that you can access. This data can be pr - [First login flow](md/_identity_broker_first_login.md): When users log in through identity brokering, Keycloak imports and links aspects of the user within the realm’s local da - [Post login flow](md/_identity_broker_post_login_flow.md): Post login flow is useful for the situations when you want to trigger some additional authentication actions after every - [Retrieving external IDP tokens](md/retrieving-external-idp-tokens.md): With Keycloak, you can store tokens and responses from the authentication process with the external IDP using the Store - [Link existing user to the identity provider](md/link-existing-user-to-the-identity-provider.md): In the typical usage, the identity provider will automatically register new user to the Keycloak storage once user is au - [Identity broker logout](md/identity-broker-logout.md): When logging out, Keycloak sends a request to the external identity provider that is used to log in initially and logs t - [SSO protocols](md/sso-protocols.md): This section discusses authentication protocols, the Keycloak authentication server and how applications, secured by the - [OpenID Connect](md/con-oidc_server_administration_guide.md): OpenID Connect (OIDC) is an authentication protocol that is an extension of OAuth 2.0. - [SAML](md/_saml.md): SAML 2.0 is a similar specification to OIDC but more mature. It is descended from SOAP and web service messaging specifi - [OpenID Connect compared to SAML](md/ref-saml-vs-oidc_server_administration_guide.md): The following lists a number of factors to consider when choosing a protocol. - [Distribution Registry v2 authentication](md/_docker.md): Docker authentication is disabled by default. To enable docker authentication, see the Enabling and disabling features g - [Managing access to realm resources](md/_admin_permissions.md): Each realm created on the Keycloak has a dedicated Admin Console from which that realm can be managed. The master realm - [Master realm access control](md/_master_realm_access_control.md): The master realm in Keycloak is a special realm and treated differently than other realms. Users in the Keycloak master - [Dedicated realm admin consoles](md/_per_realm_admin_permissions.md): Each realm has a dedicated Admin Console that can be accessed by going to the url /admin/{realm-name}/console. Users wit - [Delegating realm administration using permissions](md/_fine_grained_permissions.md): You can delegate realm management to other administrators, the realm administrators, using the fine-grained admin permis - [Fine grained admin permissions V1](md/fine-grained-admin-permissions-v1.md): Sometimes roles like manage-realm or manage-users are too coarse grain and you want to create restricted admin accounts - [Managing organizations](md/_managing_organizations.md): When integrating with a third party like a customer or business partner, you might want to manage their identities separ - [Enabling organizations in Keycloak](md/_enabling_organization_.md): To use organizations, you have to enable the feature for the current realm. - [Managing an organization](md/managing-an-organization.md): From the Organizations section, you can manage all the organizations in your realm. - [Managing organization domains](md/managing-organization-domains_server_administration_guide.md): The domain associated with an organization plays an important role in how organization members authenticate to a realm a - [Managing attributes](md/_managing_attributes_.md): An administrator can store additional metadata about an organization using attributes. An organization attribute is a ke - [Managing members](md/_managing_members_.md): An organization member is basically a realm user but with a link to one or more organizations. They are logically separa - [Managing groups](md/_managing_groups_.md): Organization groups let you organize members into logical teams, departments, or any hierarchical structure that makes s - [Managing identity providers](md/_managing_identity_provider_.md): An organization might have its own identity provider as the single source of truth for their identities. In this case, y - [Authenticating members](md/authenticating-members_server_administration_guide.md): When you enable organizations for a realm, user authentication is changed. If the user is recognized to be authenticatin - [Common setup recipes](md/common-organization-setup-recipes_server_administration_guide.md): This section provides step-by-step instructions for common organization configurations. Each recipe shows how to achieve - [Mapping organization claims](md/_mapping_organization_claims_.md): To map organization-specific claims into tokens, a client needs to request the organization scope when sending authoriza - [Managing workflows](md/_managing_workflows.md): Keycloak Workflows is a powerful engine to automate and orchestrate realm administrative tasks, bringing key capabilitie - [Understanding workflows](md/_understanding_workflows_.md): A workflow is an activity or process within Keycloak that executes a series of predefined steps on a specific realm reso - [Understanding the workflow definition](md/_understanding_workflow_definition_.md): Workflows are defined in YAML format. This format allows for a clear and human-readable way to specify the automation pr - [Understanding the workflow expression language](md/_workflow_expression_language_.md): Some settings from the workflow definition can be defined using a boolean expression language, the Workflow Expression L - [Managing workflows](md/_managing_workflows_.md): Workflows can be managed through the Admin Console or the Admin REST API. - [Triggering workflows on events](md/_workflow_events_.md): The on setting defines the event that will trigger the workflow. You should choose the event accordingly to the realm re - [Scheduling workflows](md/_scheduling_workflows_.md): Workflows can be scheduled to run periodically according to a defined interval. This is done using the schedule setting - [Defining conditions](md/_workflow_conditions_.md): The optional if setting allows you to define the conditions, as expressions, that the target resource must meet in order - [Defining steps](md/_workflow_steps_.md): The steps setting allows you to define the step chain, which is a sequence of actions to be executed during the lifetime - [Understanding the workflows engine](md/_understanding_workflows_engine_.md): The lifecycle and execution of workflows in Keycloak is managed by the Workflows Engine. The engine is responsible for p - [Handling failures](md/_handling_failures_.md): The workflows engine keeps track of the execution process by storing the step that should run in a state table. If the s - [Listening to workflow provider events](md/_workflow_provider_events_.md): During the lifecycle of a workflow execution, Keycloak fires a series of provider events that represent key moments such - [Troubleshooting workflows](md/_troubleshooting_workflows_.md): When workflows are not behaving as expected, server logs are the primary tool for understanding what is happening. The w - [Security considerations](md/_workflow_security_considerations_.md): When designing workflows, it is important to understand the trust boundaries between the event that triggers a workflow, - [Understanding common use cases](md/_understanding_common_use_cases_.md): Workflows can be used to automate a wide range of administrative tasks within a realm. Here are some common use cases wh - [Managing users and groups through SCIM](md/_managing_scim.md): SCIM (System for Cross-domain Identity Management) is a standard protocol designed to simplify identity management acros - [Enabling SCIM for a realm](md/_enabling_scim_.md): Once the feature is enabled on the server, you must also enable SCIM for each realm individually. This can be done throu - [Accessing the SCIM endpoints](md/_scim_accessing_endpoints_.md): All SCIM endpoints require authorization using an OAuth 2.0 Bearer Token. - [Protection of administrative resources](md/_scim_admin_resource_protection_.md): Keycloak automatically protects administrative users and groups from being modified through the SCIM API. This prevents - [Understanding the SCIM endpoints](md/_understanding_scim_endpoints_.md): All SCIM endpoints use the application/scim+json content type for both requests and responses, as specified by RFC 7644. - [Accessing the SCIM service provider configuration](md/_accessing_scim_service_provider_config_.md): As per the SCIM specification, the Service Provider Configuration endpoint (/ServiceProviderConfig) provides metadata ab - [Managing users](md/_scim_managing_users_.md): The SCIM /Users endpoint allows you to create, read, update, and delete realm user resources in Keycloak. User resources - [Managing groups](md/_scim_managing_groups_.md): The SCIM /Groups endpoint allows you to create, read, update, and delete realm group resources in Keycloak. Group resour - [Filtering resources](md/_scim_filtering_resources.md): The SCIM API in Keycloak supports the full filter syntax defined in RFC 7644, Section 3.4.2.2, allowing you to search fo - [Mapping user attributes to SCIM schemas](md/_scim_mapping_attributes_.md): Keycloak uses the User Profile configuration to define how user attributes are mapped to SCIM schema attributes. A set o - [Managing schema extensions](md/_scim_managing_schema_extensions_.md): In addition to the core SCIM user and group schemas, Keycloak supports schema extensions that allow you to expose additi - [Managing OpenID Connect and SAML Clients](md/assembly-managing-clients_server_administration_guide.md): Clients are entities that can request authentication of a user. Clients come in two forms. The first type of client is a - [Managing OpenID Connect clients](md/_oidc_clients.md): OpenID Connect is the recommended protocol to secure applications. It was designed from the ground up to be web friendly - [Creating a SAML client](md/_client-saml-configuration.md): Keycloak supports SAML 2.0 for registered applications. POST and Redirect bindings are supported. You can choose to requ - [Client links](md/con-client-links_server_administration_guide.md): To link from one client to another, Keycloak provides a redirect endpoint: /realms/realm_name/clients/{client-id}/redire - [OIDC token and SAML assertion mappings](md/_protocol-mappers.md): Applications receiving ID tokens, access tokens, or SAML assertions may require different roles and user metadata. - [Generating client adapter config](md/_client_installation.md): Keycloak can generate configuration files that you can use to install a client adapter in your application’s deployment - [Client scopes](md/_client_scopes.md): Use Keycloak to define a shared client configuration in an entity called a client scope. A client scope configures proto - [Client Policies](md/_client_policies.md): To make it easy to secure client applications, it is beneficial to realize the following points in a unified way. - [Configuring Keycloak as a Verifiable Credential Issuer](md/_oid4vci.md): This feature is in preview and is not fully supported. It is disabled by default and can be enabled with --features=oid4 - [What are Verifiable Credentials?](md/what-are-verifiable-credentials.md): Verifiable Credentials are the digital equivalent of physical credentials like passports, driver’s licenses, or universi - [The Issuer-Holder-Verifier Model](md/the-issuer-holder-verifier-model.md): Verifiable Credentials rely on a trust model built around three distinct roles: - [Why Use OpenID4VCI](md/why-use-openid4vci.md): OpenID4VCI brings verifiable credential issuance into the OpenID Connect ecosystem your organization already uses. Key b - [Real-World Applications](md/real-world-applications.md): Verifiable Credentials open the door to a wide range of practical use cases: - [How Credential Issuance Works: Two Core Flows](md/how-credential-issuance-works-two-core-flows.md): OpenID4VCI defines two primary ways to issue credentials. Which one to use depends on whether the user needs to authenti - [What This Chapter Covers](md/what-this-chapter-covers.md): The rest of this chapter walks through the practical steps of configuring Keycloak as a Verifiable Credential Issuer. - [Prerequisites](md/prerequisites.md): Ensure the following requirements are met before proceeding: - [Configuring Credential Issuance in Keycloak](md/configuring-credential-issuance-in-keycloak.md): In Keycloak, Verifiable Credentials are managed through ClientScopes, with each ClientScope representing a single Verifi - [Authentication](md/authentication.md): An access token is required to authenticate API requests. - [Configuration Steps](md/configuration-steps.md): Follow these steps to configure Keycloak as a Verifiable Credential Issuer. Each section is detailed with procedures, ex - [Configuring OpenID4VCI at the Realm Level](md/configuring-openid4vci-at-the-realm-level.md): The behavior of OID4VCI across the entire realm is determined by a combination of realm settings, cryptographic keys, an - [Creating a User Account](md/_oid4vci_user_setup.md): A test user is required to simulate credential issuance and verify the setup. - [Create Client Scopes with Mappers](md/_oid4vci_client_scope.md): Client scopes define which user attributes are included in Verifiable Credentials (VCs) and therefore represent the Veri - [Create and Configure the Client](md/create-and-configure-the-client.md): Set up a client to handle Verifiable Credential (VC) requests and assign the necessary scopes. The client does not diffe - [Verifying the Configuration](md/verifying-the-configuration.md): Validate the setup by accessing the issuer metadata endpoint: - [Conclusion](md/conclusion.md): You have successfully configured Keycloak as a Verifiable Credential Issuer using the OID4VCI protocol. This setup lever - [Credential Offer via Application Initiated Action](md/_oid4vci_credential_offer_aia.md): Keycloak provides a built-in Application Initiated Action (AIA) called verifiable_credential_offer that allows client ap - [Requesting Credentials](md/_oid4vci_credential_request.md): This section explains how a wallet interacts with Keycloak to request and obtain a Verifiable Credential using the Autho - [Managing Issued Credentials](md/_oid4vci_managing_credentials.md): Before issuing credentials, administrators must configure an OID4VCI client scope and assign a verifiable credential to - [Testing with third-party wallets](md/testing-with-third-party-wallets.md): This section describes how to setup Keycloak for the integration with some third-party wallets. - [Proof Types and Key Binding in OID4VCI](md/_oid4vci_proofs.md): A credential proof in OID4VCI is a cryptographic proof-of-possession that a wallet sends to an issuer (Keycloak) to show - [Example projects](md/_oid4vci_example_projects.md): For the illustration purpose, it is possible to use some example projects, which might be useful for quickstart OID4VCI - [Using a vault to obtain secrets](md/_vault-administration.md): Keycloak currently provides two out-of-the-box implementations of the Vault SPI: a plain-text file-based vault and Java - [Key resolvers](md/_vault-key-resolvers.md): All built-in providers support the configuration of key resolvers. A key resolver implements the algorithm or strategy f - [Configuring auditing to track events](md/configuring-auditing-to-track-events.md): Keycloak includes a suite of auditing capabilities. You can record every login and administrator action and review those - [Auditing user events](md/auditing-user-events.md): You can record and view every event that affects users. Keycloak triggers login events for actions such as successful us - [Auditing admin events](md/auditing-admin-events.md): You can record all actions that are performed by an administrator in the Admin Console. The Admin Console performs admin - [Mitigating security threats](md/mitigating_security_threats.md): Security vulnerabilities exist in any authentication server. See the Internet Engineering Task Force’s (IETF) OAuth 2.0 - [Host](md/host.md): Keycloak uses the public hostname in several ways, such as within token issuer fields and URLs in password reset emails. - [Admin endpoints and Admin Console](md/admin-endpoints-and-admin-console.md): Keycloak exposes the administrative REST API and the web console on the same port as non-administrative usage. Do not ex - [Brute force attacks](md/password-guess-brute-force-attacks.md): A brute force attack attempts to guess a user’s password by trying to log in multiple times. Keycloak has brute force de - [Password policies](md/password-policies.md): Ensure you have a complex password policy to force users to choose complex passwords. See the Password Policies chapter - [Read-only user attributes](md/read_only_user_attributes.md): Typical users who are stored in Keycloak have various attributes related to their user profiles. Such attributes include - [Validate user attributes](md/validate_user_attributes.md): With the functionality in Managing user attributes, administrators can restrict the data users enter for attributes, for - [Clickjacking](md/clickjacking.md): Clickjacking is a technique of tricking users into clicking on a user interface element different from what users percei - [SSL/HTTPS requirement](md/sslhttps-requirement.md): OAuth 2.0/OpenID Connect uses access tokens for security. Attackers can scan your network for access tokens and use them - [CSRF attacks](md/csrf-attacks.md): A Cross-site request forgery (CSRF) attack uses HTTP requests from users that websites have already authenticated. Any s - [Unspecific redirect URIs](md/unspecific-redirect-uris_server_administration_guide.md): Make your registered redirect URIs as specific as feasible. Registering vague redirect URIs for Authorization Code Flows - [FAPI compliance](md/fapi-compliance.md): To make sure that Keycloak server will validate your client to be more secure and FAPI compliant, you can configure clie - [OAuth 2.1 compliance](md/oauth-2-1-compliance.md): To make sure that Keycloak server will validate your client to be more secure and OAuth 2.1 compliant, you can configure - [Compromised access and refresh tokens](md/compromised-access-and-refresh-tokens.md): Keycloak includes several actions to prevent malicious actors from stealing access tokens and refresh tokens. The crucia - [Compromised authorization code](md/compromised-authorization-code.md): For the OIDC Auth Code Flow, Keycloak generates a cryptographically strong random value for its authorization codes. An - [Open redirectors](md/open-redirectors.md): An open redirector is an endpoint using a parameter to automatically redirect a user agent to the location specified by - [Mitigating Server-Side Request Forgery (SSRF)](md/ssrf.md): Server-Side Request Forgery (SSRF) is a security vulnerability where an attacker induces the server (Keycloak, in this c - [Password database compromised](md/password-database-compromised.md): Keycloak does not store passwords in raw text but as hashed text, using the PBKDF2-HMAC-SHA512 message digest algorithm. - [Limiting scope](md/limiting-scope.md): By default, new client applications have unlimited role scope mappings. Every access token for that client contains all - [Limit token audience](md/limit-token-audience.md): In environments with low levels of trust among services, limit the audiences on the token. See the OAuth2 Threat Model a - [Limit Authentication Sessions](md/_limit-authentication-sessions.md): Authentication sessions track the state of the authentication. The text below is applicable regardless of the source flo - [SQL injection attacks](md/sql-injection-attacks.md): Currently, Keycloak has no known SQL injection vulnerabilities. - [Account Console](md/_account-service.md): Keycloak users can manage their accounts through the Account Console. They can configure their profiles, add two-factor - [Accessing the Account Console](md/accessing-the-account-console.md): You can also ask for additional scopes when calling the account console URL by setting the scope parameter in this forma - [Configuring ways to sign in](md/configuring-ways-to-sign-in.md): You can sign in to this console using basic authentication (a login name and password) or two-factor authentication. For - [Viewing device activity](md/viewing-device-activity.md): You can view the devices that are logged in to your account. - [Adding an identity provider account](md/adding-an-identity-provider-account.md): You can link your account with an identity broker. This option is often used to link social provider accounts. - [Accessing other applications](md/accessing-other-applications.md): The Applications menu item shows users which applications you can access. In this case, only the Account Console is avai - [Viewing group memberships](md/viewing-group-memberships.md): You can view the groups you are associated with by clicking the Groups menu. If you select Direct membership checkbox, y - [Admin CLI](md/admin-cli.md): With Keycloak, you can perform administration tasks from the command-line interface (CLI) by using the Admin CLI command - [Installing the Admin CLI](md/installing-the-admin-cli.md): Keycloak packages the Admin CLI server distribution with the execution scripts in the bin directory. - [Using the Admin CLI](md/using-the-admin-cli.md): The Admin CLI makes HTTP requests to Admin REST endpoints. Access to the Admin REST endpoints requires authentication. - [Sensitive Options](md/sensitive-options.md): Sensitive values, such as passwords, may be specified as command options. That is generally not recommended. There are a - [Authenticating](md/authenticating.md): When you log in with the Admin CLI, you specify: - [Working with alternative configurations](md/_working_with_alternative_configurations.md): By default, the Admin CLI maintains a configuration file named kcadm.config. Keycloak places this file in the user’s hom - [Basic operations and resource URIs](md/basic-operations-and-resource-uris.md): The Admin CLI can generically perform CRUD operations against Admin REST API endpoints with additional commands that sim - [Realm operations](md/realm-operations.md): Use the create command on the realms endpoint to create a new enabled realm. Set the attributes to realm and enabled. - [Role operations](md/role-operations.md): Use the roles endpoint to create a realm role. - [Client operations](md/client-operations.md): Use the get command on the clients endpoint to list clients. - [User operations](md/user-operations.md): Run the create command on the users endpoint to create a new user. - [Group operations](md/_group_operations.md): Use the create command on the groups endpoint to create a new group. - [Identity provider operations](md/identity-provider-operations.md): Use the serverinfo endpoint to list available identity providers. - [Storage provider operations](md/storage-provider-operations.md) - [Adding mappers](md/adding-mappers.md) - [Authentication operations](md/authentication-operations.md): You can get the current realm configuration by filtering all output except for the passwordPolicy attribute.