Keycloak Metrics Endpoint
You turn on the keycloak metrics endpoint by enabling telemetry settings during server startup. This setup opens a management port that sends out health and login data. Many teams set this up fast to watch server load and memory use. Still, broad network rules or shared admin roles can expose private system data. Anyone who can reach that port might read internal server counts and realm states. How the keycloak metrics endpoint works Keycloak runs on a Java engine that tracks internal server
Keycloak + Endpoint Detection & Response (EDR): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You turn on the keycloak metrics endpoint by enabling telemetry settings during server startup. This setup opens a management port that sends out health and login data. Many teams set this up fast to watch server load and memory use. Still, broad network rules or shared admin roles can expose private system data. Anyone who can reach that port might read internal server counts and realm states.
How the keycloak metrics endpoint works
Keycloak runs on a Java engine that tracks internal server events and login counts. When you turn on metrics, the server starts a separate management listener. This listener sits on its own port away from normal user login traffic. External scraping tools read this port on a set timer to collect numbers. They gather memory size, database pool states, and active user session counts.
You can also add custom event listeners to track user logins and errors. These listeners turn realm events into plain text counters for your graphs. The server holds these numbers in memory until a scraper reads them. Teams use these charts to spot slow database queries or failed login spikes. Good graphs help engineers fix memory leaks before the whole login server crashes.
Why you must isolate the management port
By default, the management port does not check user roles before sending data. Any person or app on the same network can read the raw numbers. If you put this port on a public network, strangers can read system details. Attackers use these numbers to learn your realm names and peak traffic times. They can also see when your database pools run out of free slots.
Teams must keep the management port on a private internal network at all times. You should set firewall rules so only your scraping tool can reach it. Never route public web traffic to the port that serves your health metrics. Separating user traffic from admin ports is a core rule for safe operations. It stops outsiders from probing your internal server state during an attack.
Keycloak + Endpoint Detection & Response (EDR): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native metrics and roles leave open
Setting up the keycloak metrics endpoint helps you watch identity server health. Yet it only tells you how the login server itself runs each day. Once a user logs in and gets a token, Keycloak steps back. The identity server cannot see what that user does inside your databases later. It only knows that a valid user asked for a token and got one.
This leaves a big gap when engineers need to fix live production systems. A developer might log in with Keycloak to run a quick database check. Native identity metrics show the login worked, but miss the actual SQL commands. Also, teams often grant broad admin roles in Keycloak to avoid daily blocks. Those wide roles let users read raw emails, phone numbers, or card numbers. You need a way to check every single command and hide private data.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Does the metrics port slow down user logins?
No, keeping metrics in memory uses very little processor power or ram. The server writes simple number counters that do not block active user logins. Just make sure your scraping tool does not poll the port every second.
Can I track failed logins per realm with this setup?
Base server metrics focus on Java memory, threads, and database connection pools. To see failed logins per realm, you must add an event listener extension. That extension counts login events and adds them to the main metrics output.
How do I stop users from reading the metrics page?
Bind the management listener to a private internal IP address on your host. Then use network firewall rules to block all traffic except your collector server. Never expose the management port on your public load balancer or web router.