{"id":2698,"date":"2025-04-15T08:35:48","date_gmt":"2025-04-15T08:35:48","guid":{"rendered":"https:\/\/blog.bioaffix.com\/?p=2698"},"modified":"2025-08-28T09:17:54","modified_gmt":"2025-08-28T09:17:54","slug":"strong-authentication-with-keycloak-saml-and-confluence-integration","status":"publish","type":"post","link":"https:\/\/blog.bioaffix.com\/en\/software\/strong-authentication-with-keycloak-saml-and-confluence-integration\/","title":{"rendered":"Strong Authentication with Keycloak: SAML and Confluence Integration"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Today, a significant majority of companies rely on modern identity management systems to authenticate and authorize users accessing their applications. In addition to being a leading manufacturer of biometric-based access control and security solutions, Ones Technology\u00ae uses Keycloak for identity authentication and authorization \u2014 providing secure access to product information, user guides, technical documents, customer and integrator resources, and developer content. By integrating diverse technologies, the company continues to deliver more flexible and secure solutions tailored to customer needs, while remaining committed to continuous improvement and innovation.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">The use of Single Sign-On (SSO) strengthens resilience against cyberattacks by storing user credentials in a central, secure location and minimizing data sharing across systems. This approach serves as a critical security measure, particularly for organizations managing a large number of users and systems.<\/p>\n<\/blockquote>\n\n\n\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"480\" loading=\"lazy\" src=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-SSO-edited.webp?resize=640%2C480&#038;ssl=1\" alt=\"\" class=\"wp-image-2325\" srcset=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-SSO-edited.webp?w=1221&amp;ssl=1 1221w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-SSO-edited.webp?resize=300%2C225&amp;ssl=1 300w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-SSO-edited.webp?resize=1024%2C767&amp;ssl=1 1024w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-SSO-edited.webp?resize=768%2C576&amp;ssl=1 768w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This article provides a detailed overview of how Keycloak is implemented at Ones Technology\u00ae, covering SAML integration, Jira-based user synchronization, and access management through Confluence Scroll Viewport. It delivers comprehensive insights into the company\u2019s corporate identity authentication and authorization processes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is Keycloak?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Keycloak is an open-source, Java-based platform developed by Red Hat that provides identity and access management. Keycloak allows users to perform authentication and authorization through a central system and to access different applications via a Single Sign-On (SSO) mechanism. With the widespread use of the internet and the increasing number of applications today, it has become necessary to create a separate account for each service. Over time, managing these accounts can become complex and inefficient. This is where Single Sign-On comes into play, simplifying the user experience and enhancing security by providing access to multiple services with a single set of credentials.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Keycloak\u2019s Core Components<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Realm<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Realms are isolated domains within Keycloak that manage independent sets of users, roles, and clients. Each realm has its own authentication and authorization rules, allowing for separate security policies to be applied to different user groups and applications.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Example<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">developer \u2192 The realm where company developers log in.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">customer \u2192 The area where customers access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">integrator \u2192 The area where integrators log into the system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each of these is managed independently and can have separate user databases.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"Clients-(\u0130stemciler)\">Clients<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Clients are the applications and services that perform authentication through Keycloak.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\">Web applications, mobile apps, or API services are defined as clients.<\/li>\n\n\n\n<li class=\"\">Each client has specific authentication and authorization configurations.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"Users-(Kullan\u0131c\u0131lar)\">Users<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Users are the real individuals registered in the system who are authenticated.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\">User information can be stored in Keycloak\u2019s internal database or sourced from external directory services like LDAP or Active Directory.<\/li>\n\n\n\n<li class=\"\">Additionally, in the solution we developed at Ones Technology, one-way user synchronization can be established from a Jira to Keycloak.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"Roles-(Roller)\">Roles<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Roles define the access permissions granted to users. Thanks to roles, it is determined what actions each user can perform in the system.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Example Roles<\/h5>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\">Admin \u2192 A user with all permissions.<\/li>\n\n\n\n<li class=\"\">Editor \u2192 A user with permission to create and edit content.<\/li>\n\n\n\n<li class=\"\">User \u2192 A user who can only view content.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"Identity-Providers-(Kimlik-Sa\u011flay\u0131c\u0131lar\u0131)\">Identity Providers<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This is the component that enables user authentication from external systems.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\">It can integrate with corporate directories like LDAP and Active Directory, as well as social identity providers like Google and Facebook.<\/li>\n\n\n\n<li class=\"\">This structure makes it easy to implement authentication processes that are compatible with existing user systems.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"SAML-(Security-Assertion-Markup-Language)-Nedir?\">What is SAML (Security Assertion Markup Language)?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">SAML (Security Assertion Markup Language) is a federated identity authentication protocol generally used to enable users to securely access multiple applications or services. Working with an XML-based format, SAML carries authentication and authorization information. This protocol is used to verify user identities and provide authorization by transmitting data between an Identity Provider (IdP) and a Service Provider (SP). SAML is widely preferred for providing a single sign-on (SSO) experience, especially in corporate environments and for cloud-based services.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When a user attempts to access a Service Provider (SP) platform, the system first communicates with the Identity Provider (IdP) to verify the user&#8217;s identity. When the authentication is successful, the IdP sends a SAML Response. This response contains information about the user&#8217;s identity (e.g., username, email address, permissions), which is received by the SP to grant the user appropriate access permissions. Thus, the user can securely access all integrated platforms by signing in just once, without having to log in to each service separately.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An example SAML Response is as follows:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?&gt;\n&lt;samlp:Response\n    xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"\n    xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\"\n    ID=\"response-12345\"\n    Version=\"2.0\"\n    IssueInstant=\"2025-03-16T12:34:56Z\"\n    Destination=\"https:\/\/customer-help.bioaffix.com\/saml\/acs\"\n    InResponseTo=\"request-12345\"&gt;\n\n    &lt;saml:Issuer&gt;https:\/\/sso.bioaffix.com\/realms\/BioAffix&lt;\/saml:Issuer&gt;\n\n    &lt;saml:Assertion ID=\"assertion-67890\" IssueInstant=\"2025-03-16T12:34:56Z\"&gt;\n        \n        &lt;saml:Issuer&gt;https:\/\/sso.bioaffix.com\/realms\/BioAffix&lt;\/saml:Issuer&gt;\n        \n        &lt;saml:Subject&gt;\n            &lt;saml:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\"&gt;inancd@ones.com.tr&lt;\/saml:NameID&gt;\n            &lt;saml:SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"&gt;\n                &lt;saml:SubjectConfirmationData \n                    NotOnOrAfter=\"2025-03-16T12:44:56Z\" \n                    Recipient=\"https:\/\/customer-help.bioaffix.com\/saml\/acs\"\/&gt;\n            &lt;\/saml:SubjectConfirmation&gt;\n        &lt;\/saml:Subject&gt;\n\n        &lt;saml:Conditions NotBefore=\"2025-03-16T12:34:56Z\" NotOnOrAfter=\"2025-03-16T12:44:56Z\"&gt;\n            &lt;saml:AudienceRestriction&gt;\n                &lt;saml:Audience&gt;https:\/\/customer-help.bioaffix.com&lt;\/saml:Audience&gt;\n            &lt;\/saml:AudienceRestriction&gt;\n        &lt;\/saml:Conditions&gt;\n\n        &lt;saml:AuthnStatement AuthnInstant=\"2025-03-16T12:34:56Z\" SessionIndex=\"session-12345\"&gt;\n            &lt;saml:AuthnContext&gt;\n                &lt;saml:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport&lt;\/saml:AuthnContextClassRef&gt;\n            &lt;\/saml:AuthnContext&gt;\n        &lt;\/saml:AuthnStatement&gt;\n        \n        &lt;saml:AttributeStatement&gt;\n            &lt;saml:Attribute Name=\"email\"&gt;\n                &lt;saml:AttributeValue&gt;inancd@ones.com.tr&lt;\/saml:AttributeValue&gt;\n            &lt;\/saml:Attribute&gt;\n            &lt;saml:Attribute Name=\"role\"&gt;\n                &lt;saml:AttributeValue&gt;user&lt;\/saml:AttributeValue&gt;\n            &lt;\/saml:Attribute&gt;\n        &lt;\/saml:AttributeStatement&gt;\n\n    &lt;\/saml:Assertion&gt;\n&lt;\/samlp:Response&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Confluence Scroll Viewport is a tool used to publish Confluence content in a website format. Users (for customer, developer, and integrator documentation) who want to access the help portal are authenticated via Keycloak and log in with differently authorized groups.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Distinction Between Roles and Authorization in Keycloak<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Keycloak provides flexible and secure access control by separating role management and authorization processes. Understanding the difference between these two concepts will help you make the right configurations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Role Management<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A <strong>Role<\/strong> is a construct used to assign specific permissions to users. In Keycloak, roles are generally used to determine users&#8217; <strong>access levels<\/strong>. For example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\">A <em>customer <\/em>role might only have access to customer data.<\/li>\n\n\n\n<li class=\"\">A <em>developer <\/em>role might have access to more technical resources and administrative permissions on the system.<\/li>\n\n\n\n<li class=\"\">An <em>integrator <\/em>role might carry the authority to integrate with third-party systems. <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A user can have multiple roles; for instance, a developer can also have a customer role. This way, the user&#8217;s access to different parts of the system can be authorized. Keycloak allows roles to be created in a hierarchical structure, meaning a parent role can inherit the permissions of its child roles.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Authorization<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Authorization determines which resources, services, or data a user can access. Authorization is used to further specialize roles and ensure users access the correct resources. In Keycloak, a user is authorized with a role, but the authorization process is controlled not only at the role level but also at the group and permission levels.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, if you use <strong>different groups<\/strong>, each group can have access to different resources:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\">Customer group: A user in this group can only access customer information and reports.<\/li>\n\n\n\n<li class=\"\">Developer group: A user in this group can access the system&#8217;s technical infrastructure.<\/li>\n\n\n\n<li class=\"\">Integrator group: A user in this group can access APIs and data for integration with external systems.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Keycloak allows you to manage authorization on a realm and group basis, enabling you to create custom roles and access levels for each. This way, you can create different user types for different projects and apply separate authorization policies for each project.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example Scenario<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s say we have three groups: customer, developer, and integrator. The roles and authorization for these groups could be as follows:<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Customer<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\">customer_role: Access to customer data (BioAffix User and Installation Guide).<\/li>\n\n\n\n<li class=\"\">customer_admin_role: Permission to manage and edit customer data.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Developer<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\">developer_role: Access to the application and software infrastructure, permission to report bugs.<\/li>\n\n\n\n<li class=\"\">developer_admin_role: Ability to perform software updates and administrative actions on the system.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Integrator<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"\">integrator_role: Ability to connect with third-party systems, access to APIs.<\/li>\n\n\n\n<li class=\"\">integrator_admin_role: Permission to manage and configure external system integrations.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For each realm, roles and the users assigned to these roles can be configured with different authorization levels. For instance, a developer user can access technical data associated with the developer group, while the customer group can only access customer data and may not have permission to use the APIs in the integrator group. In this way, custom roles and authorization processes can be designed for each group.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Using the Keycloak REST API<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In addition to creating users with the REST API in Keycloak, you can also programmatically perform all the actions you can do in the management interface via the API. Below are the basic steps to obtain a token and create a user.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To get a token, you first need to send a request to Keycloak\u2019s token endpoint. This is usually located at the <em>\/protocol\/openid-connect\/token<\/em> endpoint.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"398\" loading=\"lazy\" src=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Token.webp?resize=640%2C398&#038;ssl=1\" alt=\"\" class=\"wp-image-2326\" srcset=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Token.webp?resize=1024%2C637&amp;ssl=1 1024w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Token.webp?resize=300%2C187&amp;ssl=1 300w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Token.webp?resize=768%2C478&amp;ssl=1 768w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Token.webp?w=1526&amp;ssl=1 1526w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Token.webp?w=1280&amp;ssl=1 1280w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">From this response, you can extract the <em>access_token<\/em> and use it in your API requests. If you want to examine the provided access token, the JWT Token Description from the website <a href=\"http:\/\/jwt.io\" target=\"_blank\" rel=\"noreferrer noopener\">http:\/\/jwt.io<\/a> is as follows:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li class=\"\">Header: Specifies how the JWT is signed and which algorithm is used.<\/li>\n\n\n\n<li class=\"\">Payload: Contains the user&#8217;s identity, permissions, and other metadata. For example, exp (expiration) and iat (issued at) give the token&#8217;s validity period as a Unix timestamp value, while sid (session id) is a unique identifier assigned for the session, and scope indicates what permissions the token contains.<\/li>\n\n\n\n<li class=\"\">Signature: The formula created to understand whether the JWT is trustworthy. RSASHA256(base64UrlEncode(header) + \u201c.\u201d + base64UrlEncode(payload), Private Key)\n<ul class=\"wp-block-list\">\n<li class=\"\">Public Key \u2192 Used to verify the JWT and can be obtained from Keycloak\u2019s openid-configuration address.<\/li>\n\n\n\n<li class=\"\">Private Key \u2192 Used to sign the JWT and is stored on the Keycloak server.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"570\" loading=\"lazy\" src=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Encoded.webp?resize=640%2C570&#038;ssl=1\" alt=\"\" class=\"wp-image-2327\" srcset=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Encoded.webp?w=962&amp;ssl=1 962w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Encoded.webp?resize=300%2C267&amp;ssl=1 300w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Encoded.webp?resize=768%2C684&amp;ssl=1 768w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">User Creation Example<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To create a new user, perform the authorization process using the <em>access_token<\/em> you obtained in the previous step. Specify this token in the <em>Authorization <\/em>header and add the new user&#8217;s information in JSON format to the Body section. Then, you can create a new user by sending a POST request.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"403\" loading=\"lazy\" src=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-AddUser.webp?resize=640%2C403&#038;ssl=1\" alt=\"\" class=\"wp-image-2328\" srcset=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-AddUser.webp?resize=1024%2C645&amp;ssl=1 1024w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-AddUser.webp?resize=300%2C189&amp;ssl=1 300w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-AddUser.webp?resize=768%2C484&amp;ssl=1 768w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-AddUser.webp?w=1450&amp;ssl=1 1450w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-AddUser.webp?w=1280&amp;ssl=1 1280w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">And that&#8217;s it! We have successfully obtained our token and created a user. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At <strong>Ones Technology<\/strong>\u00ae, we developed a structure that synchronizes users from our Jira system to the Keycloak server via the API. When the user synchronization is complete, we send them an informational email with details of the portals they can access, their randomly generated password, and their email address. After the user logs into the portal with this information, they are required to change their password. Thanks to this approach, we do not store user data in our own system; instead, we ensure the process remains secure and fully controlled.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Below is an example Jira user entry and the corresponding notification email:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"385\" loading=\"lazy\" src=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Kullanicilar.webp?resize=640%2C385&#038;ssl=1\" alt=\"\" class=\"wp-image-2329\" srcset=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Kullanicilar.webp?resize=1024%2C616&amp;ssl=1 1024w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Kullanicilar.webp?resize=300%2C180&amp;ssl=1 300w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Kullanicilar.webp?resize=768%2C462&amp;ssl=1 768w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Kullanicilar.webp?resize=1536%2C923&amp;ssl=1 1536w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Kullanicilar.webp?w=1557&amp;ssl=1 1557w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Kullanicilar.webp?w=1280&amp;ssl=1 1280w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"386\" loading=\"lazy\" src=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Mail.webp?resize=640%2C386&#038;ssl=1\" alt=\"\" class=\"wp-image-2336\" srcset=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Mail.webp?resize=1024%2C618&amp;ssl=1 1024w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Mail.webp?resize=300%2C181&amp;ssl=1 300w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Mail.webp?resize=768%2C463&amp;ssl=1 768w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Mail.webp?resize=495%2C300&amp;ssl=1 495w, https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-Mail.webp?w=1102&amp;ssl=1 1102w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Easy Installation and Integration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Keycloak offers a powerful solution that simplifies the management of authentication and authorization processes. Its installation is straightforward and can typically be completed with just a few commands. You can get a Keycloak server up and running with a single command, whether using a setup (exe) (which we use) or Docker:<\/p>\n\n\n\n<pre class=\"wp-block-code has-blogar-dark-light-color has-text-color has-link-color wp-elements-db49776c9c7da92c35b46e519d5d9a5a\"><code>docker run -d -p 8080:8080 --name keycloak -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io\/keycloak\/keycloak:latest start-dev <\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This way, it becomes operational within minutes, and you can use it as an Identity Provider (IdP) without any additional configuration. After completing the installation, you can either install it on your own servers (on-premise) or host it on cloud services like Azure Kubernetes, AWS ECS, or Google Cloud Run.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">User-Friendly Authentication Pages<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On the front-end, thanks to the ready-made authentication pages that come with Keycloak, you don\u2019t have to design a login screen from scratch. For example, it provides customizable login pages, password reset forms, and session management panels for your users. Large technology firms like Ones Technology can make the login process more user-friendly and faster by offering customized login pages for their employees and users. Additionally, you can enable your users to log in with their Facebook or Google accounts, which can speed up the registration process, especially for external users, and improve the user experience.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Backend Integration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On the back-end, thanks to Keycloak\u2019s REST API and OpenID Connect support, you can easily integrate it with any backend service. For example, a .NET Core API application can perform user authentication with Keycloak and carry out JWT token validation. A mobile application (Android \/ iOS) can securely log in using Keycloak\u2019s OAuth 2.0 flows.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Integration with Various Identity Providers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Keycloak supports different identity providers. For example, it can be integrated with LDAP or Active Directory to allow employees in large corporations to log in with their company email and password.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Flexibility and Scalability<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Keycloak provides a flexible, powerful, and scalable identity management solution, making it an ideal infrastructure for both small-scale projects and large corporate systems.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"256\" loading=\"lazy\" src=\"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/KeyCloak-ile-Guclu-Kimlik-Dogrulama-scaled.gif?resize=640%2C256&#038;ssl=1\" alt=\"\" class=\"wp-image-2341\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In today&#8217;s digital world, as organizations connect to various applications and systems, entering and constantly updating user information separately for each system leads to both a loss of time and increased security risks. Sharing users&#8217; sensitive information with different systems causes this information to be stored in multiple locations, and each location becomes a potential attack surface. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With Single Sign-On (SSO), user information is stored centrally in one secure platform. Each connected application receives only the verification details it needs, reducing redundant data storage and minimizing vulnerabilities. The recent TurkNet cyber-attack illustrates why this matters: with a centralized identity provider in place, attackers would have been limited to a single target. Instead of compromising user data across multiple systems, the impact could have been contained within one isolated point \u2014 making defense stronger, simpler, and far more effective.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In conclusion, the use of SSO creates a more resilient structure against cyber-attacks by keeping user credentials in a central, secure location and limiting data sharing across all systems. This approach is a critical security measure, especially for organizations with a large number of users and systems.<\/p>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#eaecec\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading has-text-color has-link-color wp-elements-b1bc6d2887d6994e1682cd769a9ac991\" style=\"color:#ca171e\">Subscribe to the BioAffix Newsletter<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can stay informed about the latest developments by subscribing to the BioAffix e-newsletter, published quarterly.<\/p>\n\n\n<noscript class=\"ninja-forms-noscript-message\">\n\tNotice: JavaScript is required for this content.<\/noscript>\n<div id=\"nf-form-3-cont\" class=\"nf-form-cont\" aria-live=\"polite\" aria-labelledby=\"nf-form-title-3\" aria-describedby=\"nf-form-errors-3\" role=\"form\">\n\n    <div class=\"nf-loading-spinner\"><\/div>\n\n<\/div>\n        <!-- That data is being printed as a workaround to page builders reordering the order of the scripts loaded-->\n        <script>var formDisplay=1;var nfForms=nfForms||[];var form=[];form.id='3';form.settings={\"objectType\":\"Form Setting\",\"editActive\":true,\"title\":\"BioAffix Subscription\",\"default_label_pos\":\"above\",\"show_title\":\"0\",\"clear_complete\":\"1\",\"hide_complete\":\"1\",\"logged_in\":\"\",\"wrapper_class\":\"\",\"element_class\":\"\",\"form_title_heading_level\":\"3\",\"key\":\"\",\"add_submit\":\"0\",\"currency\":\"\",\"unique_field_error\":\"A form with this value has already been submitted.\",\"not_logged_in_msg\":\"\",\"sub_limit_msg\":\"The form has reached its submission limit.\",\"calculations\":[],\"formContentData\":[\"e-posta_1716481306319\",\"abone_ol_1716481278510\"],\"changeEmailErrorMsg\":\"Please enter a valid email address\",\"changeDateErrorMsg\":\"Please enter a valid date!\",\"confirmFieldErrorMsg\":\"These fields must match!\",\"fieldNumberNumMinError\":\"Number Min Error\",\"fieldNumberNumMaxError\":\"Number Max Error\",\"fieldNumberIncrementBy\":\"Please increment by \",\"formErrorsCorrectErrors\":\"Please correct the error(s) below before submitting\",\"validateRequiredField\":\"This field is required\",\"honeypotHoneypotError\":\"Honeypot Error\",\"fieldsMarkedRequired\":\"Required field(s)\",\"unique_field\":\"e-posta_1716481306319\",\"drawerDisabled\":false,\"objectDomain\":\"display\",\"allow_public_link\":0,\"embed_form\":\"\",\"ninjaForms\":\"Ninja Forms\",\"fieldTextareaRTEInsertLink\":\"Insert Link\",\"fieldTextareaRTEInsertMedia\":\"Insert Media\",\"fieldTextareaRTESelectAFile\":\"Select a file\",\"tableInsertRowAbove\":\"Insert Row Above\",\"tableInsertRowBelow\":\"Insert Row Below\",\"tableInsertColumnLeft\":\"Insert Column Left\",\"tableInsertColumnRight\":\"Insert Column Right\",\"tableDeleteRow\":\"Delete Row\",\"tableDeleteColumn\":\"Delete Column\",\"tableDeleteTable\":\"Delete Table\",\"tableLegacyNotice\":\"This content has tables in the old editor format. Custom styles are preserved until converted. Editing will update to the new format.\",\"tableLegacyConvert\":\"Convert Now\",\"tableInsertTable\":\"Insert Table\",\"dismiss\":\"Dismiss\",\"insertLink\":\"Insert Link\",\"formHoneypot\":\"If you are a human seeing this field, please leave it empty.\",\"fileUploadOldCodeFileUploadInProgress\":\"File Upload in Progress.\",\"fileUploadOldCodeFileUpload\":\"FILE UPLOAD\",\"currencySymbol\":\"&#36;\",\"thousands_sep\":\",\",\"decimal_point\":\".\",\"siteLocale\":\"en_US\",\"dateFormat\":\"m\\\/d\\\/Y\",\"startOfWeek\":\"1\",\"of\":\"of\",\"previousMonth\":\"Previous Month\",\"nextMonth\":\"Next Month\",\"months\":[\"January\",\"February\",\"March\",\"April\",\"May\",\"June\",\"July\",\"August\",\"September\",\"October\",\"November\",\"December\"],\"monthsShort\":[\"Jan\",\"Feb\",\"Mar\",\"Apr\",\"May\",\"Jun\",\"Jul\",\"Aug\",\"Sep\",\"Oct\",\"Nov\",\"Dec\"],\"weekdays\":[\"Sunday\",\"Monday\",\"Tuesday\",\"Wednesday\",\"Thursday\",\"Friday\",\"Saturday\"],\"weekdaysShort\":[\"Sun\",\"Mon\",\"Tue\",\"Wed\",\"Thu\",\"Fri\",\"Sat\"],\"weekdaysMin\":[\"Su\",\"Mo\",\"Tu\",\"We\",\"Th\",\"Fr\",\"Sa\"],\"recaptchaConsentMissing\":\"reCaptcha validation couldn&#039;t load.\",\"recaptchaMissingCookie\":\"reCaptcha v3 validation couldn&#039;t load the cookie needed to submit the form.\",\"recaptchaConsentEvent\":\"Accept reCaptcha cookies before sending the form.\",\"currency_symbol\":\"\",\"beforeForm\":\"\",\"beforeFields\":\"\",\"afterFields\":\"\",\"afterForm\":\"\"};form.fields=[{\"objectType\":\"Field\",\"objectDomain\":\"fields\",\"editActive\":false,\"order\":1,\"idAttribute\":\"id\",\"label\":\"E-Mail\",\"type\":\"email\",\"key\":\"e-posta_1716481306319\",\"label_pos\":\"above\",\"required\":1,\"default\":\"\",\"placeholder\":\"\",\"container_class\":\"\",\"element_class\":\"\",\"admin_label\":\"\",\"help_text\":\"<p><br><\\\/p>\",\"custom_name_attribute\":\"email\",\"personally_identifiable\":1,\"value\":\"\",\"drawerDisabled\":false,\"manual_key\":1,\"desc_text\":\"<p><br><\\\/p>\",\"disable_browser_autocomplete\":0,\"field_label\":\"E-Posta\",\"field_key\":\"e-posta_1716481306319\",\"id\":7,\"beforeField\":\"\",\"afterField\":\"\",\"parentType\":\"email\",\"element_templates\":[\"email\",\"input\"],\"old_classname\":\"\",\"wrap_template\":\"wrap\"},{\"objectType\":\"Field\",\"objectDomain\":\"fields\",\"editActive\":false,\"order\":2,\"idAttribute\":\"id\",\"label\":\"Subscribe\",\"type\":\"submit\",\"processing_label\":\"Completing\",\"container_class\":\"\",\"element_class\":\"\",\"key\":\"abone_ol_1716481278510\",\"drawerDisabled\":false,\"manual_key\":1,\"admin_label\":\"\",\"field_label\":\"Abone Ol\",\"field_key\":\"abone_ol_1716481278510\",\"id\":8,\"beforeField\":\"\",\"afterField\":\"\",\"value\":\"\",\"label_pos\":\"above\",\"parentType\":\"textbox\",\"element_templates\":[\"submit\",\"button\",\"input\"],\"old_classname\":\"\",\"wrap_template\":\"wrap-no-label\"}];nfForms.push(form);<\/script>\n        <\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Today, a significant majority of companies rely on modern identity management systems to authenticate and authorize users accessing their applications. In addition to being a leading manufacturer of biometric-based access control and security solutions, Ones Technology\u00ae uses Keycloak for identity authentication and authorization \u2014 providing secure access to product information, user guides, technical documents, customer [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":2704,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"nf_dc_page":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[153],"tags":[],"class_list":["post-2698","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-software"],"acf":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/blog.bioaffix.com\/wp-content\/uploads\/2025-04-15-KeyCloak-ile-Guclu-Kimlik-Dogrulama-Cover.webp?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/posts\/2698","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/comments?post=2698"}],"version-history":[{"count":9,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/posts\/2698\/revisions"}],"predecessor-version":[{"id":2935,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/posts\/2698\/revisions\/2935"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/media\/2704"}],"wp:attachment":[{"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/media?parent=2698"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/categories?post=2698"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.bioaffix.com\/en\/wp-json\/wp\/v2\/tags?post=2698"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}