please-open.it @please-open-it.bsky.social · 02/10/2026Keycloak 26.8.0 is available on @clever.cloud ! www.keycloak.org/2026/10/keyc...keycloak.orgKeycloak 26.8.0 releasedVerifiable Credential Issuance promoted to preview with credential management and revocation * Verify credentials with OID4VP (experimental) * React to account status changes with Shared Signals Frame... 021
please-open.it @please-open-it.bsky.social · 16/07/2026oidc-bash now supports JWT Authorization grant ! github.com/please-openi...github.comGitHub - please-openit/oidc-bash-client: a bash openid connect clienta bash openid connect client. Contribute to please-openit/oidc-bash-client development by creating an account on GitHub. 022
please-open.it @please-open-it.bsky.social · 15/07/2026How to import a postgres database on @clever.cloud blog.please-open.it/posts/import...blog.please-open.itImport Postgres Databases in Clever.CloudImport your Keycloak (or more !) Postgres database in Clever.Cloud 011
please-open.it @please-open-it.bsky.social · 04/06/2026A few months ago, we launched a "Keycloak as a Service" offering with a partner: @clever.cloud The product evolves with each iteration: IP filtering, metrics, HA, autoscaling, OAuth2proxy for all runtimes... Here's a quick overview of everything we've done. blog.please-open.it/posts/keyclo...blog.please-open.itKeycloak as a ServicePlease-open.it has partnered with Clever-Cloud to offer a complete and accessible Keycloak as a Service. 043
please-open.it @please-open-it.bsky.social · 28/05/2026Secondary Email in Keycloak: blog.please-open.it/posts/second... allow users to add a verified secondary email and choose which one to share during authentication. 001
please-open.it @please-open-it.bsky.social · 12/05/2026www.clever.cloud/developers/c... www.clever.cloud/developers/d...clever.cloudKeycloak 26.6 with per-realm IP filteringKeycloak 26.6 is available on Clever Cloud and adds IP filtering to restrict admin, public and SCIM endpoints per realm 000
please-open.it @please-open-it.bsky.social · 12/05/2026with @clever.cloud we just released a new version of Keycloak As A Service - Keycloak version 26.6.1 (Workflows, SCIM...) - Per-realm IP filtering (based on caddy) ! - CC_KEYCLOAK_ADMIN_IPS - CC_KEYCLOAK_ADMIN_IPS_<REALM> - CC_KEYCLOAK_PUBLIC_IPS_<REALM> - CC_KEYCLOAK_SCIM_IPS_<REALM> 111
please-open.it @please-open-it.bsky.social · 04/03/2026Lock your session without logging out in Keycloak by using a PIN code blog.please-open.it/posts/acr-lo...blog.please-open.itGet self-locking sessions in Keycloak with PIN step-up authenticationKeycloak supports of Authentication Context Class Reference allows you to add so low friction PIN re-authentication for sensitive actions. Adressing one of the most and unadressed problem of authentic... 023
please-open.it @please-open-it.bsky.social · 22/01/2026oauth2proxy configuration generator for Keycloak blog.please-open.it/posts/oauth2...blog.please-open.itKeycloak OAuth2-Proxy Configuration Generator: Simplify Your Reverse Proxy Authentication SetupDiscover our new Keycloak SPI extension that automatically generates OAuth2-Proxy configurations. Export ready-to-use environment variables or complete configuration files directly from your Keycloak ... 002
please-open.it @please-open-it.bsky.social · 20/01/2026European Companies: if you host your data with a US cloud provider, you are not GDPR-compliant. ⚠️ The Cloud Act overrides data location. Yes, even if your servers are in Europe. ⬇️ blog.please-open.it/posts/cloud-...blog.please-open.itWhy Your European Business Is Probably Breaking GDPR Law Right NowHow american and european laws are conflicting putting european businesses in an impossible situation. 010
please-open.it @please-open-it.bsky.social · 23/12/2025An authentication proxy is the best pattern for deploying SSO on existing and new apps. The proxy is in charge of the authentication mechanism, the application receive authenticated requests with the user's details in HTTP Headers. blog.please-open.it/posts/auth-p...blog.please-open.itAuthentication Proxy: Simplify Authentication in Any ApplicationDiscover how to add authentication to any application without code changes using our NGINX-based OpenID Connect proxy. Separate authentication from development, define public vs private URLs, and depl... 002
please-open.it @please-open-it.bsky.social · 02/12/2025After oidc-bash, we tried to make a JWT Decoder in bash. It was so complicated with the signatures! github.com/please-openi...github.comGitHub - please-openit/jwt-decode-bash: a bash script to decode and verify jwt tokensa bash script to decode and verify jwt tokens. Contribute to please-openit/jwt-decode-bash development by creating an account on GitHub. 033
please-open.it @please-open-it.bsky.social · 27/11/2025Another module for Keycloak : user attribute regexp mapper Because in Keycloak user attributes are multivalued (with ability to aggregate them with "user attribute mapper"), we added a regexp filter only to send back attribute if it matches. github.com/please-openi...github.comGitHub - please-openit/keycloak-user-attribute-regexp-mapperContribute to please-openit/keycloak-user-attribute-regexp-mapper development by creating an account on GitHub. 001
please-open.it @please-open-it.bsky.social · 06/11/2025New Keycloak module : groups regexp mapper. Map only groups (to a token, userinfo...) that only matches to a RegExp github.com/please-openi...github.comGitHub - please-openit/keycloak-groups-regexp-mapperContribute to please-openit/keycloak-groups-regexp-mapper development by creating an account on GitHub. 000
please-open.it @please-open-it.bsky.social · 31/07/2025Map HTTP headers to claims in tokens. We built this to support locales during a client_credentials authentication process blog.please-open.it/posts/keyclo...blog.please-open.itA custom http header to token claim mapper for KeycloakMap an HTTP header value to a claim in a token. This solution was needed for a specific use case : keep the user locale. 012
please-open.it @please-open-it.bsky.social · 30/07/2025We built a desktop JWT decoder, directly accessible from the system tray : blog.please-open.it/posts/jwt_de... github.com/please-openi... 020
please-open.it @please-open-it.bsky.social · 05/06/2025An authenticator to match rfc8252 8.12 ! "native apps MUST NOT use embedded user-agents to perform authorization requests and allows that authorization endpoints MAY take steps to detect and block authorization requests in embedded user-agents" blog.please-open.it/posts/user-a...blog.please-open.itUser Agent Filter AuthenticatorWe develop a new plugin for Keycloak that filters the user-agent header on authentication request. 001
please-open.it @please-open-it.bsky.social · 30/12/2024Deploy keycloak on dokku Ready for production, with themes and SPIs built directly please-open.it/blog/keycloa...please-open.itPlease Open It BlogKeycloak as a service - oauth2/openid connect consulting 012
please-open.it @please-open-it.bsky.social · 02/12/2024In Keycloak, you MUST take a look and uncheck "full scope allowed" checkbox if you use roles. blog.please-open.it/full-scope-a... 101
please-open.it @please-open-it.bsky.social · 20/11/2024a "no code" event-listener for Keycloak with @n8n-io.bsky.social blog.please-open.it/event-listen...blog.please-open.itPlease Open It BlogKeycloak as a service - oauth2/openid connect consulting 012
please-open.it @please-open-it.bsky.social · 06/11/2023How and why we built our own authorizations platform. Spoiler : avoid "authorizations as code" platforms, what you need is a specific data model for your needs blog.please-open.it/authz/blog.please-open.itOur vision about authorizationsAfter years of consulting, we created our own authorization platform 052
