please-open.it

MFA Selector ensures mandatory Multi-Factor Authentication without mandating a personal device. Employees choose their factor (biometrics, hardware key, etc.). ✅ Secure access + Employee privacy = Win-Win. blog.please-open.it/posts/mfa-se... #CyberSecurity #MFA #OpenSource #keycloak

Keycloak 26.8.0 is available on @clever.cloud ! www.keycloak.org/2026/10/keyc...

oidc-bash now supports JWT Authorization grant ! github.com/please-openi...

How to import a postgres database on @clever.cloud blog.please-open.it/posts/import...

A few months ago, we launched a "Keycloak as a Service" offering with a partner: @clever.cloud The product evolves with each iteration: IP filtering, metrics, HA, autoscaling, OAuth2proxy for all runtimes... Here's a quick overview of everything we've done. blog.please-open.it/posts/keyclo...

Secondary Email in Keycloak: blog.please-open.it/posts/second... allow users to add a verified secondary email and choose which one to share during authentication.

Lock your session without logging out in Keycloak by using a PIN code blog.please-open.it/posts/acr-lo...

oauth2proxy configuration generator for Keycloak blog.please-open.it/posts/oauth2...

European Companies: if you host your data with a US cloud provider, you are not GDPR-compliant. ⚠️ The Cloud Act overrides data location. Yes, even if your servers are in Europe. ⬇️ blog.please-open.it/posts/cloud-...

An authentication proxy is the best pattern for deploying SSO on existing and new apps. The proxy is in charge of the authentication mechanism, the application receive authenticated requests with the user's details in HTTP Headers. blog.please-open.it/posts/auth-p...

After oidc-bash, we tried to make a JWT Decoder in bash. It was so complicated with the signatures! github.com/please-openi...

Another module for Keycloak : user attribute regexp mapper Because in Keycloak user attributes are multivalued (with ability to aggregate them with "user attribute mapper"), we added a regexp filter only to send back attribute if it matches. github.com/please-openi...

New Keycloak module : groups regexp mapper. Map only groups (to a token, userinfo...) that only matches to a RegExp github.com/please-openi...

Map HTTP headers to claims in tokens. We built this to support locales during a client_credentials authentication process blog.please-open.it/posts/keyclo...

We built a desktop JWT decoder, directly accessible from the system tray : blog.please-open.it/posts/jwt_de... github.com/please-openi...

An authenticator to match rfc8252 8.12 ! "native apps MUST NOT use embedded user-agents to perform authorization requests and allows that authorization endpoints MAY take steps to detect and block authorization requests in embedded user-agents" blog.please-open.it/posts/user-a...

Deploy keycloak on dokku Ready for production, with themes and SPIs built directly please-open.it/blog/keycloa...

In Keycloak, you MUST take a look and uncheck "full scope allowed" checkbox if you use roles. blog.please-open.it/full-scope-a...

a "no code" event-listener for Keycloak with @n8n-io.bsky.social blog.please-open.it/event-listen...

How and why we built our own authorizations platform. Spoiler : avoid "authorizations as code" platforms, what you need is a specific data model for your needs blog.please-open.it/authz/