The Complete Practical Guide to Identity and Access Management

Read before you buy: the PDF here is a free sample — the first 20 pages of the 446-page book (payments, sales and reviews on this demo site are sample data). Get the full e-book at thenexbooks on Gumroad.

Stop reinventing login. Build a secure, standards-based identity platform with Keycloak.

Every application eventually needs to answer two questions: who is this? and what are they allowed to do? A users table and a login form work until the second app arrives, followed by a mobile app, a partner API, and requests for single sign-on, MFA, and company-directory login. At that point identity is a platform, not a feature.

Keycloak is a widely used open-source platform for exactly this job. Getting a first login working takes minutes. Understanding the protocols well enough to secure real applications, designing a clean authorization model, and running Keycloak reliably in production takes a lot longer. This book covers that whole path and explains why each setting exists.

What's inside

• Identity and access management concepts, plus OAuth 2.0 and OpenID Connect explained in plain words
• Running Keycloak with Docker and PostgreSQL, and the core concepts: realms, clients, users, roles, and groups
• The right flow for every app: SPAs with PKCE, APIs with proper token validation, server-side apps and the BFF pattern, service accounts, and mobile apps
• Working examples with React and keycloak-js, a Node.js API with jose, and Spring Boot
• Registration, profiles, required actions, password policies, OTP, WebAuthn passkeys, and custom authentication flows
• Social login, external OIDC and SAML identity providers, and LDAP / Active Directory federation
• Designing roles, groups, and scopes; claims, mappers, client scopes, token lifetimes, and logout
• Fine-grained Authorization Services, multi-tenancy with realms and Organizations, and B2B scenarios
• Themes and branding, the Admin REST API, kcadm, Terraform, configuration as code, and custom SPI extensions
• Events and auditing, production deployment (hostname, TLS, reverse proxies), clustering, the Kubernetes Operator, hardening, upgrades, backups, and troubleshooting

One running example, start to finish. You build the identity platform for Alderbrook Health, a fictional clinic network with a patient portal, staff console, clinic API, mobile app, and partner lab. It needs SSO, MFA, directory login, SAML federation, fine-grained roles, and high availability.

Honest about versions. Keycloak changes between releases, so the book flags features whose status may differ, describes Admin Console navigation in general terms, and points you to the official guides where details matter. No invented benchmarks or sizing numbers.

Format: PDF, 446 pages (A4), linked table of contents and bookmarks. English. First Edition, 2026. Published by thenexbooks. This book is independent and is not affiliated with or endorsed by the Keycloak project.

Table of Contents

Part I — Foundations

• Ch 1 · Why Identity Matters: IAM, Single Sign-On, and Where Keycloak Fits
• Ch 2 · OAuth 2.0 and OpenID Connect in Plain Words
• Ch 3 · Getting Started: Running Keycloak Locally with Docker
• Ch 4 · Core Concepts: Realms, Clients, Users, Roles, and Groups
• Ch 5 · Your First Protected App: Logging In with OpenID Connect

Part II — Securing Applications

• Ch 6 · Single-Page Applications: Authorization Code Flow with PKCE
• Ch 7 · Securing APIs: Access Tokens, Audiences, and Token Validation
• Ch 8 · Server-Side Web Apps and the Backend-for-Frontend Pattern
• Ch 9 · Service-to-Service Security: Client Credentials and Service Accounts
• Ch 10 · Mobile and Native Apps

Part III — Users and Authentication

• Ch 11 · Managing Users: Registration, Profiles, and Required Actions
• Ch 12 · Authentication Flows: Passwords, One-Time Codes, and WebAuthn Passkeys
• Ch 13 · Identity Brokering: Social Login and External Identity Providers
• Ch 14 · User Federation with LDAP and Active Directory
• Ch 15 · SAML 2.0 Applications and Providers

Part IV — Authorization and Tokens

• Ch 16 · Designing Your Authorization Model: Roles, Groups, and Scopes
• Ch 17 · Tokens in Depth: Claims, Mappers, Client Scopes, Lifetimes, and Logout
• Ch 18 · Fine-Grained Authorization Services: Resources, Policies, and Permissions
• Ch 19 · Multi-Tenancy: Realms, Organizations, and B2B Scenarios

Part V — Customization and Automation

• Ch 20 · Themes and Branding: Login Pages, Emails, and Account Console
• Ch 21 · Automating Keycloak: Admin REST API, kcadm, and Terraform
• Ch 22 · Configuration as Code: Realm Export, Import, and GitOps
• Ch 23 · Extending Keycloak with SPIs: Custom Authenticators and Event Listeners
• Ch 24 · Events, Auditing, and Security Monitoring

Part VI — Production

• Ch 25 · Production Deployment: Database, Hostname, TLS, and Reverse Proxies
• Ch 26 · High Availability: Clustering, Caching, and the Kubernetes Operator
• Ch 27 · Operating Keycloak: Hardening, Upgrades, Backups, and Troubleshooting
• Ch 28 · Case Study: Building Alderbrook Health's Identity Platform

Appendices
A · Cheat Sheet
B · Templates and Reference
C · Production Checklist
D · Glossary

Book details