Thomas Darimont thomasdarimont

The generic outbox: explainer and user guide

Part 1: Explainer

What it is

A transactional outbox: a durable queue inside Keycloak's own database for messages that must leave Keycloak reliably but must not be sent from inside the request that produced them.

The pattern: the code that handles a login, an admin change or a user removal writes a row to

I'd like to get feedback on a design and a working prototype for a long-standing request: restricting which users may use which clients, based on roles, group membership or user attributes, for a single client or a set of clients ("application groups"). Today people solve this with a conditional subflow plus the Deny Access authenticator, or with community extensions such as keycloak-restrict-client-auth. Both approaches stop at the browser flow: they do not cover token refresh, direct grant or client credentials, and per-client flow overrides do not scale to sets of clients.

The prototype lives on my fork:

Keycloak + Apple Business Integration

This guide describes how to integrate Keycloak with Apple Business Manager (ABM) as a Custom Identity Provider, using OIDC for authentication and SSF (Shared Signals Framework) for propagating session and credential change events.

Note that the frontend hostname that Keycloak uses as issuer for the ssf-configuration endpoint.

Keycloak Setup

SSF Transmitter Support in Keycloak

Design-and-scope overview of the Shared Signals Framework (SSF) transmitter feature landed on branch issue/gh-xxx-ssf-tx-support-v1. Keycloak acts as an SSF Transmitter — receivers authenticated via OAuth pull or are pushed signed Security Event Tokens (SETs) describing user / session / credential events that happen in the realm.

Feature flag: Profile.Feature.SSF — experimental, opt-in.

	import com.google.auto.service.AutoService;
	import jakarta.persistence.EntityManager;
	import jakarta.persistence.TypedQuery;
	import lombok.extern.jbosslog.JBossLog;
	import org.keycloak.Config;
	import org.keycloak.connections.jpa.JpaConnectionProvider;
	import org.keycloak.models.KeycloakSession;
	import org.keycloak.models.KeycloakSessionFactory;
	import org.keycloak.models.RealmModel;
	import org.keycloak.models.RoleModel;

	import com.google.auto.service.AutoService;
	import org.jboss.logging.Logger;
	import org.keycloak.Config;
	import org.keycloak.OAuth2Constants;
	import org.keycloak.models.AuthenticatedClientSessionModel;
	import org.keycloak.models.Constants;
	import org.keycloak.models.KeycloakSession;
	import org.keycloak.models.KeycloakSessionFactory;
	import org.keycloak.provider.ProviderConfigProperty;
	import org.keycloak.representations.RefreshToken;

	/*
	* PATCHED Version of RedirectUtils to work around issue https://github.com/keycloak/keycloak/issues/51712 based on https://github.com/keycloak/keycloak/blob/26.7.2/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java.
	* See PATCH:BEGIN / PATCH:END sections for the changes.
	*
	* To allow OIDC-Parameters in redirect URIs start Keycloak with the env variable KC_PATCH_ALLOW_OIDC_PARAMS_IN_REDIRECT_URIS=true.
	*
	* Note: These class must be adapted/aligned with every Keycloak version update.
	*/
	/*
	* Copyright 2016 Red Hat, Inc. and/or its affiliates

	# Builder image for compiling Keycloak from source, see build-dockerized.sh
	ARG JAVA_VERSION=21
	FROM eclipse-temurin:${JAVA_VERSION}-jdk

	# Node / pnpm versions should match the ones declared in the Keycloak js/pom.xml
	# (node.version / pnpm.version) of the version being built.
	ARG NODE_VERSION=24.9.0
	ARG PNPM_VERSION=10.14.0

	RUN apt-get update && \

	#!/usr/bin/env zsh
	# Manual end-to-end test for the Identity Assertion JWT (ID-JAG) token-exchange flow.
	#
	# Prereq: start Keycloak with the experimental feature enabled, e.g.
	# bin/kc.sh start-dev --features=identity-assertion-jwt,token-exchange
	#
	# Requires: curl, jq, openssl (all standard on macOS).
	set -u

	BASE=${BASE:-http://localhost:8081}

	package demo;

	import org.jboss.logging.Logger;
	import org.keycloak.Config;
	import org.keycloak.events.Event;
	import org.keycloak.events.EventListenerProvider;
	import org.keycloak.events.EventListenerProviderFactory;
	import org.keycloak.events.admin.AdminEvent;
	import org.keycloak.models.KeycloakSession;
	import org.keycloak.models.KeycloakSessionFactory;