Extensions

See below for a list of community maintained extensions for Keycloak. Note that those extensions are not vetted by the Keycloak team, and are maintained independent third parties. Only install extensions from parties that your trust, as these extensions will get access to sensitive data managed in Keycloak.

To add an extension, open an issue on GitHub.

keycloak-config-cli: Configuration as Code for Keycloak realms

Utility to ensure the desired configuration state for a realm based on a JSON or YAML file.

1.2k stars

Adaptive Authentication

Leverage Authentication policies, Risk-based authentication, and AI as part of an Adaptive authentication initiative.

97 stars

Alias Guard

User Profile validator and event listener that canonicalizes email addresses (Gmail dots, +tags) and blocks registration or email change when the mailbox is already taken. One inbox — one account.

3 stars

Ansible collection for Keycloak

Collection to install and configure Keycloak

134 stars

Keycloak App Passwords

Generate app specific passwords in Keycloak

20 stars

Apple Identity Provider

Sign in with Apple using either a browser or natively by token_exchange.

289 stars

BundID Integration

Integrate German BundID identity provider (https://id.bund.de) including support for attribute requests and mapping of STORK QAA levels.

37 stars

Cap Captcha

Adds trycap.dev cap (proof-of-work + instrumentation) CAPTCHA validation to the Keycloak registration flow. Self-hostable, fail-closed server-side verification via cap's reCAPTCHA-compatible siteverify endpoint.

0 stars

CAS Login Procotol

Implements the CAS SSO protocol according to official specification by adding a new client type to the Keycloak admin console.

124 stars

Cassandra Datastore

Use Apache Cassandra as storage backend. Can be used to just replace Infinispan as distributed cache. Requires experimental map storage feature.

28 stars

Client Certificate Lookup for Envoy

Retrieves the client certificate from the x-forwarded-client-cert (XFCC) header set by Envoy Proxy.

9 stars

Keycloak Client Webhook

Enables per-client webhook setup in Keycloak for environment-specific configurations.

Crossplane provider for Keycloak

Use it to configure realms, user, groups etc. via Kubernetes manifests in a declarative way.

64 stars

EDP Keycloak Operator

Kubernetes operator to configure realms, clients, users, groups, identity providers, and more via CRDs in a declarative way.

91 stars

Event Listener Utilities

Useful event listener implementations and utilities. Webhooks, scripts, HTTP, etc.

308 stars

Extended SAML Identity Provider

Facilitates direct (synchronous) SAML requests to external providers, like eHerkenning or DigiD.

15 stars

Keycloak External Claim Mapper

Implementation of the keycloak internal SPI protocol-mapper, that allows to fetch remote http json data, transform and include it into user JWT.

14 stars

Filtered Group Membership Mapper

A Keycloak Protocol Mapper that extends the built-in Group Membership Mapper by allowing regex-based exclusion of groups before they are included in tokens.

1 stars

France Connect Identity Provider

Extension to add support for the french administration Identity Provider France Connect.

105 stars

Keycloak GeoAware

Keycloak-GeoAware is an advanced feature extension for Keycloak that integrates geolocation and device monitoring into the authentication process. This extension utilizes IP-based location and device information to define custom access policies that provide more granular control and additional login security.

18 stars

Keycloak Helm Chart codecentric

This Helm Chart is a modern Kubernetes deployment package for Keycloak. It provides a highly performant and scalable setup that simplifies the configuration of external databases, custom themes, extensions, distributed caching and much more.

Keycloak Helm Chart HelmForge

Production-ready Helm chart for Keycloak on Kubernetes with dev/production modes, external database support, and ingress configuration.

HiOrg-Server Identity Provider

Keycloak extension to add HiOrg-Server as an identity provider.

Home IdP Discovery

The authenticator redirects users to their home identity provider based on their email address and domain.

339 stars

Keycloakify

A tool for creating Keycloak theme with React

2.5k stars

kcwarden - Keycloak Config Auditor

Check your Keycloak realm configuration for common security issues.

123 stars

KETE

Streams events to various destinations in various formats

31 stars

Magic Link Login

Allow users to authenticate through a link sent to their email address instead of using a password.

415 stars

MFA Plugin collection

A collection of MFA plugins: SMS authenticator, Enforce MFA, Native App MFA integration.

275 stars

Keycloak Minecraft Identity Provider

A Keycloak Identity Provider plugin that enables authentication via Microsoft/Xbox OAuth2 and resolves the brokered login identity to the Minecraft Java player name when a Java profile exists, otherwise to the Xbox Gamertag for supported Bedrock logins.

3 stars

Keycloak Multi-Tenancy

Keycloak extension for creating multi-tenant IAM for B2B SaaS applications.

173 stars

ORCID Social Identity Provider

Enables ORCID as an Identity Provider.

17 stars

Organizations Extensions

Comprehensive extensions set for single realm multi-tenancy.

539 stars

Keycloak Personal Access Tokens

A Keycloak plugin that lets users create personal access tokens (PATs) — scoped, named tokens that can be used as passwords anywhere HTTP Basic Auth is accepted

0 stars

PII Data Encryption

Enables database-level encryption of PII user data such as username, email, first name, last name and custom user attributes.

36 stars

Keycloak Platform SSO

Allows device and user registration of Apple's Platform Single Sign-on for macOS computers.

38 stars

PostgreSQL OAuth Validator

Delegate PostgreSQL authorization decisions to Keycloak using OAuth tokens, leveraging Keycloak Authorization Services for fine-grained, token-based access control.

28 stars

privacyIDEA two factor authentication

Adds 2nd factors to keycloak, that are authenticated against your central privacyIDEA system.

122 stars

Keycloak Proof of Work

Adds computational PoW (proof-of-work) challenges to Keycloak flows. Protects against bot spam and brute-force attacks by requiring clients to solve a light cryptographic puzzle before authenticating.

Push MFA

Adds a push-based second factor to Keycloak that works in tandem with a mobile app implementing the custom protocol

8 stars

QR Code Authentication

Sign with another device using QR Codes. This extension enables users to complete authentication with another device by scanning a QR code.

12 stars

Quarkus/Quarkiverse extensions

Add any Quarkus or Quarkiverse extensions to your Keycloak deployment.

20 stars

Regex role importer

This extension provides a broker mapper that maps a multivalued OIDC claim or SAML attribute to roles based on regular expressions.

21 stars

Keycloak REST Claim Mapper

Custom OIDC Protocol Mapper for Keycloak 26.x that enriches federated users with attributes fetched from one or more external REST APIs at token issuance time.

2 stars

Restrict Client Auth

The authenticator supports role-based or policy-based access decisions and can be enabled on a per-client basis.

429 stars

Keycloak SCIM Server

Adds SCIM v2.0 support to Keycloak for user and group provisioning using standard REST APIs. Supports bearer token authentication (e.g. Entra ID) and works at both realm and organization levels.

93 stars

Keycloak shadcn Theme

A Keycloakify-based Keycloak theme built with shadcn/ui where light/dark logo, favicon and theme colors are configurable at runtime from the admin console — no theme rebuild required. Ships a bundled Theme Config SPI (REST endpoint + Realm Settings UI tab)

9 stars

Terraform provider for Keycloak

Use it configure realms, user, groups etc. from your Terraform scripts in a declarative way.

933 stars

Testcontainers

A Testcontainers implementation for Keycloak.

455 stars

Keycloak Theme Editor

A visual editor for designing, previewing, and exporting Keycloak login themes.

53 stars

TikTok Identity Provider

Keycloak extension to add TikTok as an identity provider.

6 stars

Token Authenticator

A Keycloak authenticator that enables login using an ID token or Access token.

1 stars

Vault Provider for OpenBao and HashiCorp Vault

Use OpenBao and HashiCorp Vault as external secret storage for Keycloak.

11 stars

Less active

(Not active for more than 1 year)

Block Disposable Email

Prevent users from registering with a disposable email addresses.

12 stars

Discord Identity Provider

Keycloak extension to add discord as an identity provider.

157 stars

GitHub SSH key mapper

An attribute mapper for the Github Identity Provider. The mapper can fetch the user's SSH keys from github's REST API.

20 stars

IBM Security Verify Authenticator

Adds various authentication methods such as One-time-passcode, QR code, Push notifications, and FIDO2.

31 stars

Impersonation Policy Enforcer

Enforces an impersonation policy restricting impersonators from accessing clients unless holding an associated client role.

13 stars

Japanese documentation translation

Japanese translation of the Keycloak documentation.

43 stars

JSON Remote Claim Mapper

Protocol mapper to retrieve JSON data from a remote HTTP endpoint.

56 stars

Metrics SPI

Adds a Metrics Endpoint to Keycloak in Prometheus format.

617 stars

MQTT event listener

An event listener using the MQTT protocol.

46 stars

OpenFGA Event Publisher

Keycloak extension enables event integration between Keycloak and OpenFGA for Fine-Grained Authorization (FGA).

60 stars

Passport.js strategy

Passport.js strategy that enables the use of multiple realms in the same application.

104 stars

Python Client

Client library for python applications.

58 stars

RabbitMQ event listener

Event listener using the RabbitMQ message broker.

168 stars

WS-Federation protocol

Implementation of the WS-Federation passive requestor model according to the official specification.

38 stars