Keycloak Extensions Demo

Demos, examples and playground for Keycloak extensions, providers, SPI implementations, etc.

Provided AS-IS - no warranties, no guarantees.
Just for demonstration purposes only!

This repository contains the following extensions, and probably (most likely 😉) more...

Extension Modules

Authentication & Authorization

• MagicLink Authenticator - Passwordless authentication via magic link sent to user's email
• Authenticators - Collection of various demo authenticators including:
• CAPTCHA integration
• Deny/block authenticator
• MFA implementations
• MFA enrollment flows
• Redirect authenticators
• Registration enhancements
• Conditional Authenticators - Conditional logic for authentication flows based on:
• HTTP headers and values (or negated values)
• Authentication session notes and values
• Custom conditions

User Management

• Flintstones User Provider - Demo user storage provider with HTTP-based API, supporting read/write operations with the Flintstones family members
• Required Actions - Custom required actions (e.g., MobileNumberRequiredAction for enforcing mobile phone number updates)
• Validators - Custom validation providers for user attributes and forms

Event Processing

• Event Listeners - Multiple event listener implementations:
• Highlander - Session restrictor allowing only the last session to survive (single session per user) - deprecated, Keycloak can do this ootb since v23
• LastLoginTime - Stores most recent login timestamp in user attributes

Protocol & Tokens

• Token Mappers - Custom OIDC protocol token mappers (e.g., LuckyNumberMapper)
• Action Tokens - Custom action token implementations for special-purpose links

APIs & Integrations

• REST Endpoint - Custom REST resources within Keycloak with both public and authenticated endpoints
• Custom SMS SPI - Custom SMS provider service provider interface

Administration & Operations

• Admin UI Extensions - Custom Admin Console UI components and extensions
• Initializer - Realm initialization and configuration automation, including scheduled tasks
• Scheduled Tasks - Background task scheduling and cron-based operations

Communication

• Email Provider - Custom email templates and senders:
• JSON format templates for external service processing
• AWS SES integration instead of SMTP
• Vendor-specific email protocols

Security & Policies

• Passwords - Password policy extensions and custom password validators

Utilities

• Utils - Shared utilities and helper classes used across extensions
• Various - Miscellaneous extension examples and experimental features

Demo Docker Compose Environment

A docker-compose.yml is provided for local development and testing with Keycloak. The setup includes:

• Keycloak running in development mode with preview features enabled
• Remote debugging available on port 8787
• All extension modules automatically mounted into Keycloak's providers directory
• Persistent data volume for Keycloak data

Quick Start

Build all extensions and start Keycloak:

./mvnw clean package -DskipTests && docker compose up

Access

• Keycloak Admin Console: http://localhost:8080
• Admin Credentials: username admin, password admin
• Remote Debug Port: 8787

Included Extensions

All 18 extension modules are automatically loaded: - actiontoken, admin-ui, authenticators, conditional-authenticators - custom-sms-spi, email, event-listener, flintstones-userprovider - initializer, magiclink, passwords, requiredaction - rest-endpoint, scheduled-task, tokenmapper, utils - validators, various

Note: No warranties or support provided - use at your own risk for demonstration purposes only!