Keycloak - Hardened Identity and Access Management

What is Keycloak

Keycloak is an open-source identity and access management server built on Java and Quarkus. It gives applications single sign-on and standards-based authentication and authorization through OpenID Connect, OAuth 2.0 and SAML 2.0, plus realm-based multi-tenancy, role-based access control, user federation against LDAP and Active Directory, identity brokering, social login, fine-grained authorization, and a full admin and account console. Applications integrate through each realm's OIDC discovery document and the standard token endpoints, so any compliant OIDC or SAML client works without vendor SDKs. Keycloak is Apache-2.0 licensed - the same codebase as the Red Hat build of Keycloak, with no open-core feature gating.

Why self-host Keycloak

An identity provider sees every login, every token and every user attribute in your estate. Running it yourself keeps user records, credentials, session state and audit trails inside your own subscription and your own region, which is the simplest answer to GDPR data-residency and to auditors asking where authentication data lives. There is no per-user pricing to grow into and no vendor lock-in: realms, clients and users are exportable, and the protocols are open standards, so the applications you integrate today keep working whatever you run tomorrow.

What this VM image adds

Security hardening:

• Production mode on a bundled PostgreSQL - Keycloak is built and started with start --optimized against a local PostgreSQL; the embedded H2 database, which upstream supports for development only, is not used
• No password baked into the image - the admin password and the PostgreSQL password are generated uniquely per instance at first boot and written to /root/keycloak-credentials.txt, readable by root only
• nginx TLS perimeter - TLS terminated on port 443 with a self-signed certificate; Certbot and its nginx plugin are pre-installed so a CA-signed certificate is one command away
• Loopback-only services - Keycloak HTTP (8080), the management and health endpoint (9000) and PostgreSQL (5432) all bind to 127.0.0.1 and are never exposed off the VM
• CVE scan - every image is scanned for vulnerabilities with Trivy before release
• UFW firewall - only 22, 80 and 443 accepted; 80 redirects to HTTPS
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Upstream release signature verified - the Keycloak distribution is checked against the project's published signing key at build time

Quick Start

1. Deploy the VM from Azure Marketplace (Standard_D2s_v3 or larger recommended - the JVM and the bundled PostgreSQL need 8 GB)
2. Open port 443 to your own address in the network security group
3. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
4. Read the generated login: sudo cat /root/keycloak-credentials.txt
5. Open https://<PUBLIC_IP>/admin/, accept the self-signed certificate warning, and sign in as admin. First boot takes about 1-2 minutes while the database schema is prepared and the JVM warms up; until then a loading page refreshes itself.
6. Create your own administrator under the master realm, remove the generated bootstrap account, then create your first realm and register your applications as clients.

Restrict port 443 to your own address until you have signed in and created your own administrator, then replace the self-signed certificate and the IP-based hostname with your own domain using the Certbot command shown in the credentials file.