This isn’t another reverse proxy. It’s a control point. It front‑loads Keycloak’s identity and access management into every request path. It enforces authentication before traffic reaches the backend. It centralizes authorization decisions. With the Unified Access Proxy, you make the perimeter real again, even in the middle of a microservices mesh.
Keycloak Unified Access Proxy works by intercepting HTTP(S) calls, redirecting unauthenticated sessions to Keycloak for login, and injecting the necessary tokens for downstream services. It supports OIDC, SAML, and custom authentication flows. It can enforce fine‑grained access rules based on roles, groups, and claims. That means you can run legacy web apps, new APIs, and cloud‑native services behind the same security layer without code changes.
You can deploy it as a sidecar in Kubernetes. You can lock down edge traffic at an NGINX ingress. You can place it in front of monoliths, GraphQL endpoints, or WebSocket connections. The proxy handles token validation, refresh cycles, and session state. It can strip or add headers, rewrite paths, and log every request for auditing. All while Keycloak drives the authentication logic from a central instance.