Keycloak Recommended Database
PostgreSQL is the main keycloak recommended database for production workloads. You can also run MySQL or MariaDB for stable user data storage. Teams often set up these backends using a single shared admin role. That broad role lets the app create tables and update schemas at startup. Yet broad roles create risk when engineers debug live issues by hand. How the keycloak recommended database works Keycloak ships with a built-in store for local testing only. For real workloads, you must point th
Keycloak + Database Access Proxy: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
PostgreSQL is the main keycloak recommended database for production workloads. You can also run MySQL or MariaDB for stable user data storage. Teams often set up these backends using a single shared admin role. That broad role lets the app create tables and update schemas at startup. Yet broad roles create risk when engineers debug live issues by hand.
How the keycloak recommended database works
Keycloak ships with a built-in store for local testing only. For real workloads, you must point the app to an external relational database. The app uses standard drivers to read and write user records and realms. PostgreSQL leads most production setups because it handles locking and high traffic well. MySQL and MariaDB also work well when teams already run them in house.
During startup, the identity server checks the schema state right away. It runs automatic schema updates using the database role you give it. This means the app role often holds full table creation and write rights. Connection pools keep a set number of database sessions open at all times. When users log in, the app queries these pooled sessions for fast checks. Cluster nodes also use the database to share basic state across servers.
Managing database roles and schema permissions
A clean setup splits the schema migration role from the daily runtime role. The migration role needs rights to alter tables during a version upgrade. The runtime role only needs rights to read, insert, and update rows. Most teams skip this split to save time during deployment. They leave one strong database account active for both the app and staff.
Engineers also need direct database logins to fix stuck realms or check logs. They often reuse the main app credentials from the secret store. Shared accounts make it hard to see which person ran a specific query. If someone runs a bad update, every user can lose login access fast. Good role design limits who can change tables or read sensitive user rows.
Keycloak + Database Access Proxy: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native database roles solve and what they leave open
Native database roles control which account can log in to the backend store. You can restrict an engineer to read-only tables using native grants. You can also block an account from dropping tables or changing schemas. These controls stop basic mistakes at the table level.
Still, native database grants only check permissions when a session starts or queries a table. They do not inspect what individual queries do in flight. A read role still returns raw emails, phone numbers, and national IDs in full. Masking rewrites matched fields in results so sensitive strings stay safe during checks. Native roles also lack command approvals for risky updates on live identity tables. Teams must pair solid database choice with controls that govern every single query.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Can I use the built-in database for a small production app?
No, the built-in store is only for local testing and dev work. It can corrupt data under load and does not support multi-node clusters. Move to PostgreSQL, MySQL, or MariaDB before you add real users.
Which database engine gives the best results for Keycloak?
PostgreSQL is the top choice for most production identity deployments today. The core dev team tests against it heavily for every release. It handles concurrent writes and lock contention very well under high login load.
How should engineers run manual fixes on the identity database?
Avoid using the main app account for manual debugging or data checks. Give engineers separate database roles with strict read grants by default. Require peer approval before anyone runs a write query on production tables.