Keycloak Scim Extension
You set up a keycloak scim extension by adding a third-party plugin to your server. This plugin syncs users and groups from your identity store to outside apps. Teams often map broad directory groups to admin roles inside databases and cloud tools. When these roles grant wide power, one bad query can break live systems. How a keycloak scim extension works Keycloak does not include built-in SCIM support out of the box. Platform teams must install an external module or custom service provider t
Keycloak: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up a keycloak scim extension by adding a third-party plugin to your server. This plugin syncs users and groups from your identity store to outside apps. Teams often map broad directory groups to admin roles inside databases and cloud tools. When these roles grant wide power, one bad query can break live systems.
How a keycloak scim extension works
Keycloak does not include built-in SCIM support out of the box. Platform teams must install an external module or custom service provider to add it. You place the plugin package into your server folder and restart the service. Once the server starts, the plugin exposes standard web endpoints or outbound sync jobs.
The plugin watches for user events inside your main realm. When an admin adds a person, the extension sends a web request out. That request creates a matching account inside your target app or database system. When someone leaves the company, the plugin sends an update to turn off access. It also maps realm groups to roles inside the downstream tool.
What directory sync solves and what it leaves open
Automated user sync stops orphan accounts from lingering after people leave a team. It also saves admins from creating profiles by hand across dozens of tools. Your central directory stays the single source of truth for who joins which group. Audits become simpler because every active user maps back to a central identity.
Still, directory sync only controls account creation and static role mapping. It decides who can log in, not what commands they run after login. Engineers still need database roles and system rights to fix live issues. Once inside, a broad role lets them run destructive commands or drop tables.
Static sync also cannot inspect data flowing back to a user terminal. If a table holds emails, phone numbers, card numbers, or national IDs, queries return them. Directory sync has no way to rewrite matched fields in results during a query. It also cannot ask a manager to approve a single risky command before it runs.
Keycloak: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Why teams pair identity sync with runtime controls
Modern security requires both clean user lists and strict controls on live sessions. Provisioning handles the first step by putting the right users into the right groups. Runtime controls handle the second step by checking every query or command in flight.
Instead of giving engineers standing admin credentials, teams check permissions per request. A developer can connect using their normal identity and run safe read queries. When they need to change data, a peer can approve that specific action. Masking rules also rewrite emails or card numbers in results before they reach the screen. This split keeps setup simple while protecting live data from mistakes.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Does Keycloak support SCIM out of the box?
No, the core server does not include native SCIM client or server features. You must add an open-source plugin, buy a commercial extension, or write custom code.
What is the difference between SCIM and OIDC in Keycloak?
OIDC handles user logins and passes identity tokens to apps at sign-in time. SCIM runs in the background to create, update, and delete user accounts and groups.
Can SCIM restrict which SQL queries a synced user runs?
No, SCIM only creates the user account and assigns a static role or group. It cannot see or block individual database queries or shell commands during a session.