Keycloak Extensions

Dates and Booking

Is the standard Keycloak not enough? No problem—Keycloak is built from the ground up to be extensible. With Service Provider Interfaces (SPIs), you can customize nearly every aspect of the system to meet your own requirements without having to touch the core.

In this workshop, you’ll learn how Keycloak extensions work conceptually, which SPIs you’ll need most often—and you’ll implement them yourself right away. This includes automated integration tests against a real Keycloak server.

One of Keycloak’s biggest advantages is its extensibility: The SPI pattern allows you to build your own implementations and deploy them to Keycloak at runtime—without having to recompile the actual core or the distribution. Virtually every important feature in Keycloak is accessible via SPIs.

That sounds powerful—and it is. But without an understanding of the right interfaces, the ‘KeycloakSession’, the Context objects, and how the ProviderFactory and Provider work together, you’ll quickly lose track of what’s going on.

Our trainer Niko Köbler will show you how it all fits together—and you’ll implement it together. Bonus: Using his own open-source library testcontainers-keycloak—which has been used in many global projects—you’ll test the extensions you’ve developed against a real Keycloak server in an integration test—no mocking, no guesswork.

Agenda

Keycloak SPI Concepts – The Foundation

• The SPI Pattern in Keycloak: ProviderFactory and Provider Interfaces
• KeycloakSession and Context-specific objects – what is available where?
• How extensions are deployed and loaded at runtime

Implementing Two SPIs – Hands-On

• EventListener: Respond to Keycloak events (login, logout, errors, etc.)
• Authenticator: Incorporate custom authentication steps into auth flows
• (optional: RequiredAction SPI)

Automated Testing of Extensions

• Integration testing with testcontainers-keycloak
• Testing extensions against a real Keycloak server—without mocking

Your Benefits

Audience

This workshop is intended for Java developers who are already familiar with Keycloak and want to customize it to meet their specific needs using their own extensions.

Prerequisites:

• Basic knowledge of Keycloak (realms, clients, auth flows)
• Solid, up-to-date Java skills (Java 21+) and experience with Maven

• Familiarity with a Java IDE (IntelliJ IDEA, Eclipse, VS Code, …)

• Basic knowledge of Keycloak (realms, clients, auth flows)
• Solid, up-to-date Java skills (Java 21+) and experience with Maven
• Familiarity with a Java IDE (IntelliJ IDEA, Eclipse, VS Code, …)

Required:

• Notebook/laptop with local admin privileges
• Java IDE of your choice (IntelliJ IDEA, Eclipse, VS Code, …)
• JDK 21+
• Docker and Docker Compose V2 – installed and running
• Internet access

We use Docker Compose as our testing and verification environment to keep operational overhead to a minimum.

Training Objectives

Your Trainers