Keycloak Demo
You run a keycloak demo by starting the server and creating a realm. Then you add a client app and test a user login. Most teams start with a local test setup to check single sign-on flows. They create test users and assign roles to see how tokens work. Still, teams often give these test roles broad permissions to move fast. Those broad roles frequently carry over into live systems and create risk. How a keycloak demo works Keycloak is an open source tool that manages user logins and tokens.
Keycloak: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You run a keycloak demo by starting the server and creating a realm. Then you add a client app and test a user login. Most teams start with a local test setup to check single sign-on flows. They create test users and assign roles to see how tokens work. Still, teams often give these test roles broad permissions to move fast. Those broad roles frequently carry over into live systems and create risk.
How a keycloak demo works
Keycloak is an open source tool that manages user logins and tokens. When you build a keycloak demo, you first create a realm. A realm is a separate space that holds your users and apps. Each realm keeps its rules and keys away from other realms.
Next, you register a client app inside that realm. The client represents a web app or service that needs login checks. When a user visits the app, the app sends them to Keycloak. The user enters a password and completes a second login step. Keycloak checks these details against its internal user store or a directory.
After a good login, Keycloak builds a signed token for the user. This token holds the user identity and their assigned realm roles. The user browser sends this token back to the client app. The app reads the token to see who logged in. It also checks the role list to allow or block pages.
What the login setup solves and what it misses
A central login server solves a big problem for growing engineering teams. You do not need to build password checks into every single app. Teams manage users in one place and turn off accounts fast. You can also enforce two-factor login rules across all web apps at once. Standard protocols like OIDC and SAML make this setup work well.
Yet this identity setup only controls the front door during login. It checks who the user is and hands out a role token. It does not watch what the user does with backend systems later. For example, an engineer might log in and get an admin role. That role lets them open a database or run server commands.
Once the session starts, Keycloak steps out of the way. It cannot see individual SQL queries or shell commands in flight. It cannot block a bad drop table statement before it runs. It also cannot mask sensitive fields like emails or card numbers in results. If a query pulls phone numbers or national IDs, raw data comes back. Login tokens decide who gets in, not what actions run inside.
Keycloak: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Moving from a test setup to live systems
When teams move from a demo to live use, new problems appear. In a test realm, one shared admin account is easy to use. In a live setup, shared accounts ruin your audit logs. You know someone logged in, but you do not know who ran a command.
Teams also find that static roles are too blunt for daily work. A developer might need database read rights all week. They might only need write rights for ten minutes during an incident. Giving them permanent write roles in the login server creates danger. If someone steals their token, the attacker gets full write rights too.
To fix this, teams must look beyond the login token itself. You need controls that check every single query and command at runtime. You also need data masking that rewrites matched fields in query results. Pairing strong login checks with runtime controls keeps your systems safe.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the main purpose of a Keycloak realm?
A realm acts as an isolated group for your users and apps. It keeps login rules, roles, and keys separate from other teams or projects.
Does Keycloak log the database queries a user runs?
No, Keycloak only logs login events, token issues, and admin changes. It does not see or log database queries or server commands after login.
How do roles reach my app during a login flow?
Keycloak writes the user roles directly into a signed JSON token. Your app reads that token to check permissions before showing a page.