Facepalm: yet another project with custom authentication. Each of five microservices carries its own password hash database. OAuth is wrapped in PHP and Node.js crutches. We see this everywhere in legacy systems. Such architecture multiplies N+1 session tables and JWT vulnerabilities (no key rotation) and lacks single sign-on (SSO) between services. Average licensing savings when migrating from Auth0 or Okta is 60–80%.
Keycloak is an open-source Identity and Access Management from Red Hat. This self-hosted alternative to Auth0 and Okta supports OpenID Connect, OAuth 2.0, SAML 2.0. With 15+ years of IAM expertise and over 100 successful integrations, we have used Keycloak in production for many years, deploying 15+ industrial clusters. Authentication runs without failures even at 10,000 RPS. Contact us for a free analysis of your IAM infrastructure.
Why Keycloak is better than custom authentication?
Custom solutions often have problems: N+1 session tables, JWT vulnerabilities (no rotation), and lack of SSO. Keycloak solves them:
- Single user registry — no data duplication.
- Automatic JWT signing key rotation — reduces compromise risk.
- LDAP/AD support — employees log in with corporate credentials.
- Social network broker — OAuth for Google/GitHub without extra code.
Keycloak also provides a ready-made authentication UI: login pages, self-registration, password reset, MFA. All configurable via admin console. The developer focuses on business logic instead of writing middleware.
Comparison of Keycloak and custom implementation
| Criterion | Keycloak | Custom solution |
|---|---|---|
| Development | Hours to configure | Weeks or months of code |
| Security | Certified, OWASP top-10 | Risk of errors |
| Scaling | Horizontal, cluster | Requires rework |
| Protocol support | OIDC, OAuth2, SAML out of the box | Only basic OAuth2 |
How to configure LDAP integration?
In Keycloak Admin Console:
- User Federation → Add provider → LDAP.
- Specify Connection URL, Bind DN, Users DN.
- Configure attribute mapping: CN → username, mail → email.
After configuration, employees log in with corporate credentials directly through Keycloak. This is important for companies with Active Directory. The process takes 1–2 days and requires no changes in applications.
Deploying Keycloak: Docker and configuration
We recommend Docker Compose for Keycloak with PostgreSQL:
version: '3.8' services: keycloak: image: quay.io/keycloak/keycloak:latest environment: - KEYCLOAK_ADMIN=admin - KEYCLOAK_ADMIN_PASSWORD=admin - KC_DB=postgres - KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak - KC_DB_USERNAME=keycloak - KC_DB_PASSWORD=password ports: - '8080:8080' depends_on: - postgres postgres: image: postgres:15 environment: - POSTGRES_DB=keycloak - POSTGRES_USER=keycloak - POSTGRES_PASSWORD=password After starting, go to the admin console, create a realm and a client.
Configuring Realm and Client
- Create a Realm (logically isolated authentication area).
- Create a Client for the web application:
- Client type: OpenID Connect.
- Client authentication: On (confidential).
- Valid redirect URIs:
https://yourdomain.com/auth/callback. - Valid post logout redirect URIs:
https://yourdomain.com.
- Save Client ID and Client Secret (Credentials tab).
Integration with Laravel via Socialite
// config/services.php 'keycloak' => [ 'client_id' => env('KEYCLOAK_CLIENT_ID'), 'client_secret' => env('KEYCLOAK_CLIENT_SECRET'), 'redirect' => env('KEYCLOAK_REDIRECT_URI'), 'base_url' => env('KEYCLOAK_BASE_URL'), // e.g. http://localhost:8080 'realm' => env('KEYCLOAK_REALM'), ], // Socialite driver use Socialite; $user = Socialite::driver('keycloak')->user(); Direct JWT verification (for API)
Keycloak publishes JWKS at a standard URL. The API can verify JWT directly without calling Keycloak:
use Firebase\JWT\JWK; use Firebase\JWT\JWT; $jwks = json_decode(file_get_contents('https://keycloak/auth/realms/{realm}/protocol/openid-connect/certs'), true); $keys = JWK::parseKeySet($jwks); $decoded = JWT::decode($token, $keys, ['RS256']); Logout
Keycloak supports front-channel and back-channel logout (RP-Initiated Logout):
$redirectUri = 'https://yourdomain.com'; $logoutUrl = 'https://keycloak/auth/realms/{realm}/protocol/openid-connect/logout?' . http_build_query([ 'id_token_hint' => $idToken, 'post_logout_redirect_uri' => $redirectUri ]); return redirect($logoutUrl); Timeline and cost
Case study: e-commerce with SSO and LDAP
Project: 3 frontends, 2 APIs, legacy AD. Results:
- Unified login for 5000 employees via AD.
- Authentication time reduced by 40%.
- Reduced Auth0 licensing costs to zero (saving ~$50,000/year).
| Stage | What we do | Time |
|---|---|---|
| Deploy Keycloak | Docker + PostgreSQL, SSL setup | 1 day |
| Realm and clients | Create realm, client, roles, users | 0.5 day |
| Integration with Laravel | Socialite, callback, sessions | 1.5 days |
| JWT middleware | Token validation, refresh tokens | 1 day |
| LDAP/AD (optional) | Configure user federation, sync | 1–2 days |
| Testing | Unit, integration, load tests | 1 day |
Total: 5–7 business days. Typical cost starts at $3,000. Request a consultation for a free evaluation and commercial proposal.
Deliverables
- Working Keycloak infrastructure (Docker Compose, SSL, backups).
- Realm with configured clients and roles.
- Integration with Laravel via Socialite (or any framework).
- JWT middleware for API.
- LDAP/AD synchronization (on request).
- Documentation: flow diagrams, configuration details, deployment scripts.
- Video recording of team training (1 hour).
- 1 month support (Telegram/email).
We have extensive experience with Keycloak, 15+ successful integrations. Certified Red Hat specialists. With 5 years on the market and over 100 projects, we guarantee a seamless deployment. Guarantee: deploy Keycloak without downtime, configure to your compliance, train your team. Contact us for a project evaluation — we will analyze your infrastructure for free and propose an optimal solution.