Custom login actions, specific identity providers, your own user database: almost anything is possible with Keycloak extensions. We design, build and maintain them.
Let's talk about your projectKeycloak covers most standard authentication needs. When your use case goes beyond that — a specific check during login, business data to put in tokens, an existing user database to plug in — Keycloak is extended through its Service Provider Interfaces (SPI): Java extension points, packaged as a JAR and deployed next to the server, without touching its source code.
We have been building these extensions for years, for our clients and as open source.
Custom login steps: filtering by IP address, user agent or email domain, PIN codes, step-up authentication, business checks during login.
Mandatory user journeys, secure single-use links sent by email, letting users pick a secondary email address.
React to Keycloak events (login, registration, account updates, admin actions): webhooks, audit trails, sync with your tools, workflows.
Put data from an HTTP header, an API or an external identity provider into tokens, or reshape existing claims.
Plug an existing user database or an API as an identity source, authenticate LDAP-only applications through Keycloak.
New API endpoints, configuration generation for your authentication proxies, business metrics exposed to Prometheus.
Part of our work is published on GitHub and runs in production:
We share what we learn on our technical blog.
A Service Provider Interface is a Keycloak extension point: a Java interface you implement, package as a JAR and drop into the server providers folder. Authentication, token contents, user storage, events, REST endpoints: most Keycloak behaviors can be extended this way, without changing its source code.
Keycloak internal APIs change between major versions. We favor documented interfaces to limit the impact, and we can maintain your extensions at every upgrade as part of our support.
Yes, if the offer allows it. On Keycloak by Clever Cloud, you drop the JAR into the providers/ folder of the FS Bucket, then rebuild and restart the application.
Tell us about your context in a few lines: we will get back to you quickly to discuss it and suggest the right approach.
contact@please-open.it