A focused Keycloak extension Development preview
Let your customers configure single sign-on through a guided setup link. Keep accounts, permissions and connection control in your existing Keycloak.
One owner panel. One customer wizard.
See the handoff from both sides.
The setup journey
Actual product screens with example data and masked credentials.
Existing Keycloak owner
Sign in with your existing Keycloak administrator login. Choose a realm connection, or an organization when Organizations are enabled.
Set the allowed protocol, expiry and testing policy. Share the generated link with the customer's identity-provider administrator.
The recipient gets a setup link, without general Keycloak administration.
Customer's IdP administrator
Open the invitation and register an application with the customer's OpenID Connect provider. Enter its discovery or endpoint details and client credentials.
Register the exact callback shown by the wizard. Then choose the stable identity and map the profile fields your application needs.
Open the invitation and import the customer's SAML metadata, or enter its entity ID, sign-on URL and signing certificate.
Choose a stable NameID or released identity attribute. Once the draft is saved, register its exact ACS URL or import the generated service-provider metadata.
See the SAML registration screenThe wizard saves a hidden draft before testing.
Customer's IdP administrator
This invitation requires two successful sign-in tests. Sign in as the same person twice; the second test requests fresh authentication.
The checks compare the stable identifier returned by the provider. A changing or transient identifier needs correction before activation.
The two-test policy is optional for new setup links. When enabled, it cannot be bypassed.
Customer's IdP administrator
Review the configuration and activate while the required test results are current. The draft becomes a native Keycloak identity provider.
The owner can see the completed invitation. Your team can then verify an ordinary application sign-in and native account reuse.
Keycloak continues to own users, sessions and access decisions.
Step 1 of 4 Invite
Delegate the setup, keep the control
The extension handles the setup journey. Native Keycloak handles identity.
Choose its realm or organization, permitted protocol and expiry. Revoke a link when it is no longer needed. Organizations are optional.
Setup profiles are the owner's reusable rules for what a recipient can configure or change. Each invitation keeps the policy it was issued with.
Use scoped links for client-secret or signing-certificate rotation. Maintenance profiles can allow selected connection changes, with two successful tests.
Still your Keycloak. Native accounts, sessions, brokering and access policies stay with the host platform. The extension stays focused on SSO setup and maintenance.
Installation footprint
Both interfaces ship with the extension. No separate frontend service, plugin database or runtime Node installation is required.
Qualified baseline Keycloak 26.8.1
Place the JAR in Keycloak's providers/ directory, then run bin/kc.sh build before starting the optimized server.
Keep the host's supported database and connection settings. Configure the plugin's shared rate-limit key and deployment policy alongside your public hostname, proxy and TLS settings.
Use your existing Keycloak administrator login. The plugin has a separate panel; it is not a menu inside the native Admin Console.
https://YOUR-KEYCLOAK/realms/master/idp-setup/adminThe JAR adds its own metadata tables through Keycloak's existing database connection. Owner-managed setup profiles and permitted branding live in the panel; infrastructure secrets and server settings remain deployment configuration.