Keycloak

The commenter says Keycloak can do anything, but learning how to configure it takes a lot of time and the knowledge is not easy to pick up.

With Keycloak behind Apache as reverse proxy, requests randomly dropped and the user had to change obscure connection pooling or keep-alive settings.

Affects: Self-hoster using Apache

Creating a user through the admin REST API ignores the specified id and generates a random one.

Affects: Developers using the admin API

Customizing Keycloak requires reading code and knowing Java EE because many SPIs are poorly documented or undocumented, even for simple extras like profile fields.

Affects: Developers extending Keycloak

Setting up Keycloak for user management on Kubernetes needs OAuth and complex realm configuration and consumes a lot of RAM, which the commenter finds excessive.

Affects: Kubernetes operators

Affects: Self-hoster using Docker

Affects: Enterprise platform engineer on AWS ECS

Affects: Team running Keycloak in production

Affects: Teams building custom Keycloak images with themes

Affects: Admins disabling users

Affects: Admins with backchannel logout configured

Affects: Developers using token exchange

Affects: Developers using the admin API

Affects: Developers trying Keycloak locally

Affects: Admins configuring SAML SSO with external IdPs

Affects: Docker users adding health checks

Affects: Developers writing custom identity providers

Affects: Admins behind reverse proxies or custom hostnames

Affects: Developers using GitHub apps as external IdP

Affects: SPA developers

Affects: SPA developers using keycloak-js

Affects: Admins with a separate admin hostname

Affects: Admins with external identity providers

Affects: Teams using LDAP integration

Affects: Small self-hosted deployments

Affects: Operators of game servers and username-only communities

In an identifier-first flow, the password authenticator always runs before the passwordless WebAuthn one, forcing users to pick another way to use passkeys.

Affects: Admins building passwordless flows

The commenter wants Keycloak to read a config file at startup and create/update/delete resources accordingly, and dislikes the Terraform plugin because of state.

Affects: Teams running Keycloak on Kubernetes

Organizations allow several mail domains, but each linked IdP only one, forcing duplicate IdP configurations for customers with several domains.

Affects: B2B providers with customers using multiple mail domains

Partial export and import into a new realm fails on duplicate keys, so an admin needing 25 near-identical realms without command-line access wants a clone function.

Affects: Admins without command-line access managing many similar realms

Providers like Microsoft and Google are ending basic SMTP auth, so Keycloak will be unable to send email unless it supports OAuth 2.0.

Affects: Admins using Microsoft or Google mail

Affects: Teams integrating identity systems

Affects: Teams using distributed tracing

Affects: Enterprise security administrators

Affects: Teams syncing Active Directory via LDAP

Affects: Docker Compose users automating setup

Affects: Operations and SRE teams

Affects: End users and realm admins

Affects: Kubernetes teams using Helm and ArgoCD

Affects: Container and Docker secrets users

Affects: Teams syncing users and groups from an external source

Affects: Teams with a global user base on AWS

Behind a reverse proxy Keycloak connections sometimes break; the user had to add proxy settings disabling pooling and keep-alive to stabilize it.

Affects: Self-hoster using Apache as reverse proxy

Stateful login on one server was missing on others, so plain load balancing did not work and sticky sessions were the only option.

Affects: Enterprise platform engineer

Turning off Preserve Group Inheritance avoids the LDAP sync failure but loses the whole Active Directory group structure inside Keycloak.

Affects: Teams syncing Active Directory via LDAP

A self-hoster says startup is annoyingly long unless you build the optimized image, which was a pain point until done.

Affects: Self-hoster

The only way to tune CSP today is to completely override the header, which weakens it across all Keycloak endpoints.

The commenter built their own auth server after tiring of Keycloak quirks, including missing common functionality such as accepting terms before profile creation.

Affects: Product developer