Okay, so you ever notice how pretty much every app
Download transcript (.srt)
0:00
0:02
0:05
0:06
0:07
0:09
0:12
0:13
0:15
0:17
0:19
0:21
0:22
0:23
0:25
0:25
0:27
0:31
0:32
0:34
0:36
0:38
0:39
0:40
0:41
0:42
0:43
0:45
0:48
0:49
0:51
0:52
0:54
0:55
0:58
0:59
1:00
1:05
1:06
1:07
1:09
1:11
1:12
1:16
1:17
1:18
1:20
1:22
1:23
1:26
1:30
1:31
1:34
1:36
1:38
1:39
1:43
1:45
1:49
1:50
1:51
1:52
1:55
1:56
1:59
2:01
2:02
2:03
2:04
2:05
2:07
2:08
2:09
2:11
2:12
2:15
2:19
2:21
2:23
2:24
2:25
2:28
2:30
2:31
2:33
2:36
2:37
2:38
2:41
2:42
2:44
2:45
2:47
2:49
2:51
2:53
2:55
2:57
3:00
3:02
3:03
3:08
3:11
3:13
3:15
3:16
3:17
3:21
3:24
3:26
3:27
3:29
3:33
3:37
3:38
3:39
3:41
3:43
3:46
3:48
3:52
3:54
3:56
3:59
4:00
4:01
4:04
4:04
4:07
4:09
4:11
4:12
4:15
4:16
4:19
4:22
4:23
4:25
4:26
4:27
4:29
4:31
4:32
4:34
4:36
4:36
4:39
4:43
4:45
4:48
4:49
4:49
4:52
4:53
4:56
4:58
4:59
5:02
5:03
5:05
5:06
5:09
5:10
5:12
5:15
5:17
5:18
5:21
5:24
5:26
5:29
5:32
5:35
5:36
5:40
5:40
5:42
5:46
5:48
5:49
5:51
5:54
5:56
5:58
6:00
6:04
6:05
6:06
6:07
6:10
6:12
6:13
6:16
6:20
6:22
6:25
6:26
6:29
6:31
6:33
6:34
6:36
6:39
6:40
6:43
6:45
6:47
6:50
6:52
6:54
6:56
6:59
7:01
7:03
7:05
7:08
7:09
7:11
7:12
7:15
7:16
7:19
7:21
7:23
7:24
7:26
7:28
7:30
7:32
7:34
7:36
7:39
7:41
7:43
7:46
7:46
7:48
7:50
7:50
7:52
7:55
7:56
7:58
7:59
8:01
8:04
8:06
8:09
8:10
8:13
8:17
8:18
8:20
8:22
8:25
8:27
8:28
8:29
8:32
8:35
8:38
8:38
8:39
8:43
8:45
8:46
8:48
8:49
8:50
8:52
8:55
8:56
8:58
9:00
9:02
9:03
9:07
9:08
9:10
9:11
9:12
9:16
9:19
9:20
9:21
9:24
9:26
9:30
9:32
9:33
9:35
9:37
9:43
9:43
9:46
9:48
9:51
9:52
9:53
9:55
9:56
9:58
9:59
9:59
on your phone wants you to log in?
Like websites too, right?
Yeah, for sure.
Seems like it's just become this basic part
of using any online service.
Yeah, they need to know who you are
and what you're actually allowed to do
on their platform, right?
Right, and so today we're going deep
on how all that works behind the scenes.
Sounds good.
We're gonna be looking at a really cool tool
called KeyCloak.
Okay, cool.
It basically makes this whole process
way easier for developers and by extension,
much safer for everyone.
Yeah, absolutely.
Security and like user management,
those are really complex topics.
Oh, totally.
Especially if you're building
an application from scratch.
Right.
KeyCloak really helps this.
It's an open source solution that takes care
of like all the core tasks of handling logins
and permissions.
Oh, that's awesome.
And I wanna take a second to thank Safe Server
for supporting this deep dive.
They're all about supporting this kind
of important software and really empowering you
with digital sovereignty.
For sure.
You can find out more about them at www.safeserver.de.
Definitely check them out.
So yeah, with KeyCloak developers,
they can actually focus on the unique features
that make their app special.
Right, because they don't have to worry
about reinventing the wheel when it comes to security.
Yeah.
Which is a good thing.
Exactly, it's a huge win for everyone involved.
Okay, so let's say I'm using a bunch
of different online accounts.
My email, a project management tool,
a community forum, and I'm sure I'm missing a couple.
Yeah, probably a few.
Usually each of those needs its own username and password.
Aye, yeah, that can get a bit overwhelming
keeping track of all of them.
It's a nightmare.
So KeyCloak offers something called single sign-on,
or SSO, what's that all about?
So SSO with KeyCloak is kind of like having this master key.
Yeah.
You just log in once to KeyCloak,
and then you can access all these other
connected applications without having to type
in your password every single time.
So I unlock the main KeyCloak door,
and all the other apps just kind of know it's me.
Yeah, you got it.
It happens in the background.
You don't even see it.
Oh yeah, that's so convenient.
Right, and it's more secure too.
You're actually reducing the chances
of your password getting compromised
because you're not typing it in everywhere.
That's true.
Out of sight, out of mind, I guess.
So what about when I see those sign in with Google
or connect the Facebook buttons?
Oh yeah, those are everywhere now.
Keycloak helps with that too, right?
It does.
It makes adding those social login options
way easier for developers.
How so?
So instead of each app having to build
separate connections to Google, Facebook, Twitter,
you know, all of them.
Right.
Keycloak just acts as this central hub.
Okay, that makes sense.
So through Keycloak's admin console,
you just configure which social logins
you want to enable, and that's it.
So the developers don't have to write a bunch of code
to deal with each individual social network.
Exactly, it's way simpler.
Keycloak handles all the complexities for them.
So it's like Keycloak speaks all these different
social media languages for the app.
Yeah, that's a really good way to put it.
That seems like a huge time saver.
It is, and it's not limited to just social logins either.
Keycloak can also connect to existing identity systems
that companies might already be using.
You mean like internal company accounts
and things like that?
Exactly, like if they're using something
like OpenID Connect or SAML 2.0,
it acts like a translator for different digital identities
so everyone can understand each other.
Gotcha, and what's that called?
That's called identity brokering.
Imagine a company partners with another organization.
Their employees, they need to access specific resources
in your app brain.
Makes sense.
Well, with Keycloak, you don't have to create
separate accounts for all those new users.
Keycloak can just broker their existing identities
so it's all seamless.
Very cool, so let's say a company has its own system
for storing employee information
like a directory of user accounts.
Do they have to manually recreate all of that in Keycloak?
No, no, not at all.
Keycloak is smarter than that.
It has a feature called user federation.
Okay, what's that do?
This lets it connect to and sync with
those existing user directories.
So like the company's active directory
or something like that.
Exactly, so when someone new joins the company
and an account is created, Keycloak
just automatically recognizes them.
Okay, so no need to set up a separate Keycloak account
for each person.
Exactly, saves a lot of time and effort.
And helps avoid errors too, I bet.
Oh yeah, for sure.
It keeps everything consistent,
which is always a good thing in the world of IT.
Absolutely.
So we've talked about users logging in
and connecting to different systems.
Right.
But how does someone like an IT administrator
actually manage all of this in Keycloak?
So that's where the admin console comes in.
Think of it as mission control for Keycloak.
Okay.
From this web interface,
administrators can do pretty much everything.
Oh wow, like what?
They can enable or disable features,
set up the identity brokering and user federation
we just talked about,
and manage all the applications and services
that are secured by Keycloak.
Wow, okay, so it's pretty comprehensive.
Oh it is.
They can also define authorization policies,
which we'll talk about in a bit.
And of course they can manage users themselves,
including their permissions and active sessions.
Oh wow, so it really is a central point
for controlling everything.
Exactly, it gives administrators a clear overview
and control over the entire identity
and access management system.
Okay, so what about regular users?
Can they do anything themselves related to Keycloak,
like changing their password or adding extra security?
Oh, absolutely.
Keycloak has a feature called the account management console.
What's that like?
It's a self-service portal for users
where they can manage their own profile change passwords,
set up things like two-factor authentication.
Oh, that's handy.
Right, they can also see a history of their logins
and even link their social media accounts if that's enabled.
Okay, so users have a good amount of control
over their own security and information.
Exactly, and it takes some of the pressure
off IT administrators too for all those common tasks.
Which I'm sure they appreciate.
Yeah.
Now you mentioned earlier that Keycloak relies
on standard protocols like OpenID Connect
and Samuel Ale.
Why is that so important?
So using these industry standard protocols
is really crucial for Keycloak for a couple of reasons.
First, it makes sure that Keycloak can work
with a really wide range of applications and services.
Okay, how so?
Well, because these protocols are so widely used,
it's like they create a common language
for all these different systems to understand.
I see.
So applications built with different technologies
can still talk to Keycloak and use it for authentication
and authorization,
because they all speak the same language, so to speak.
Oh, so there are no compatibility issues
because they're all following the same rules.
Right, and the second reason is security.
These protocols have been tested and analyzed
by experts all over the world,
so they're generally considered really secure.
So it's not like Keycloak is just doing its own thing
in a way that could have security flaws.
Exactly, by using these proven protocols,
Keycloak benefits from all the collective knowledge
and security expertise that's gone into developing them.
Gotcha.
It's like standing on the shoulders of giants in a way.
You could say that.
So you mentioned authorization policies earlier.
Yes.
I know that it's important to know who someone is,
but I guess you also need to control
what they can actually do once they're logged in, right?
Absolutely.
Authentication is just the first step.
Authentication takes it to the next level.
Okay, so it's like checking your ID at the door,
but then also making sure you have permission
to go into specific rooms.
Exactly, it's about controlling access
to specific resources or actions within an application.
Makes sense.
So with KeyClock's authorization services,
you can get really granular with the permissions you define.
Okay.
Like you might not just have an editor role
that gives access to everything.
Right.
You could say this specific user
can only edit these particular documents, but not others.
And that would be handled through
these authorization policies.
Yeah, exactly.
It's really powerful for applications
that have sensitive data or complex requirements
like in finance or healthcare.
Yeah, where security and privacy are paramount.
So for someone who is new
to all this managing access and permissions online,
what's the key takeaway with Keycloak?
The main idea with Keycloak is that
it takes all the complicated stuff
related to identity and access management
and makes it much simpler for modern applications.
And that's good for developers and users alike.
For sure.
Keycloak handles all the hard parts
like storing user information authentication,
like proving someone is who they say they are
and authorization controlling what they can actually do.
Okay.
It's got all these great features
like single sign-on integration with existing systems,
social logins, and a central console
for managing everything.
And it's all built with security in mind
from the ground up.
Absolutely.
It lets developers focus on building great apps
without having to become security experts themselves.
That makes a lot of sense.
So it sounds like Keycloak is a really important tool
for improving both security and efficiency
for anyone working with online services.
Definitely.
And for end users, it often means a smoother, more secure
experience online.
You don't have to juggle a million different passwords.
Which is always a good thing.
It really is.
It's easy to overlook, but these behind-the-scenes systems
like Keycloak, they're what makes the internet work
the way it does today.
Oh, for sure.
They're the unsung heroes of the digital world.
And a big thanks again to Safe Server
for supporting this deep dive into Keycloak.
And for all their work in promoting digital sovereignty.
Definitely check them out.
You can learn more about what they do
and how they support important open source projects
like Keycloak by visiting www.safeserver.de.
Good stuff.
As we spend more and more of our lives online,
having secure and easy to use ways
to manage our digital identities is only
going to become more important.
I completely agree.
And open source tools like Keycloak
are playing a big role in making that happen.
Couldn't have said it better myself.
Well, thanks for joining us
Until next time.
Until next time.