Services
Keycloak, from audit to production.
Vixoris audits, installs, configures and upgrades Keycloak, and trains the team that runs it.
When we can help
Clients come to us at moments like these:
- “We are adopting Keycloak, and we want help to get it right.”
- “We are choosing between Keycloak and a SaaS identity provider.”
- “We want a sound architecture for our IAM solution.”
- “We have a Keycloak, but nobody knows how it was set up or whether it is secure.”
- “Our users are scattered across several sources: directories, Entra ID, other identity providers.”
- “The upgrade is stuck.”
- “We want a full audit of our identity and access management setup.”
- “We are facing an incident and we need help.”
- “We must roll out MFA to every user.”
What you get
- You know where you stand, and what to fix first.
- Keycloak runs in production, in high availability, connected to your apps and directories.
- Your own team runs it. We train them on your setup, so they can work without us.
The services
- Audit
- A security review of your Keycloak: users, sign-up, passwords, clients, service accounts, redirect URLs, roles. Each finding is ranked high, medium or low, with the fix we recommend.
- Architecture and scoping
- IAM and customer identity (CIAM) architecture. A review of your current sign-in setup. Scoping a new project, with a proof of concept. Keycloak compared with the market.
- Infrastructure
- VMs, Docker or Kubernetes. PostgreSQL, reverse proxy, load balancer, WAF.
- Installation
- High availability, cache cluster, health checks and metrics, database settings.
- Configuration
- Realms, OIDC and SAML clients, LDAP and Active Directory, Kerberos, outside identity providers such as Entra ID, MFA.
- Hardening
- Admin console kept off the public internet, unused URLs blocked. One admin account per person, never shared. A dedicated main admin account, as the Keycloak documentation recommends. One client per application, each with its own credentials, never shared. Brute-force protection and rate limiting. Password policy, with a list of banned passwords. MFA. Strict redirect URLs, short token lifetimes, key rotation.
- Observability and audit trail
- Metrics, dashboards and alerts with Prometheus and Grafana. Sign-in and admin events logged. Threat detection: alerts on brute-force attempts and credential stuffing. For Keycloak, or for a whole platform.
- Production readiness
- What a Keycloak needs before it goes live: several instances, an external database, sizing (CPU and memory requests and limits, number of instances), TLS, and hardening.
- Troubleshooting
- We find the cause of a broken setup, fix it, and say what to change.
- Custom development
- Keycloak extensions (SPI modules), such as a one-time code sent by email. Themes.
- Upgrades
- Keycloak versions, and the components around it.
- Training
- Administration, advanced configuration, infrastructure, themes. Remote or on site, on your own setup.
- Support and maintenance
- Help over time: version changes, incidents, audits. A fixed monthly fee, or a package of hours.
- Expert days
- Days on demand, for any of the services above.
A full project combines several services: for example infrastructure, installation, configuration, training and observability. There are two ways to run it. We do the setup, or your team does it, with our advice at each step.
An audit is a good first step. It is short, and its findings show what to do next.
Beyond Keycloak
Vixoris also builds Kubernetes platforms, delivered the GitOps way, with their observability and security monitoring. The platform hosting Klatos is a working example: how it was built.
How a job runs
- A 30-minute call: your setup, your problem, your deadline.
- A written proposal within two working days: the scope, the dates, the price, and what we need from you.
- The work. The person on the call is the person who does it.
- A written deliverable: a report, a working setup, a trained team. It names the next step.
If your company buys through a consulting firm, Vixoris works that way too.
Track record
Jean SILGA has worked with Keycloak in production since 2019.
- IAM architecture based on Keycloak at Manpower France, then Keycloak in high availability at BforBank.
- An audit for Infogreffe, expert work for AMJ Groupe, and an email one-time-code module for Septeo, delivered before the Paris 2024 Olympics.
- A 21-hour Keycloak course, and a talk at Cloud Native Orléans.
- Twice, a client's team could work alone after a few days.
- Jean is a Kubestronaut, with 15 CNCF certifications.
More on About and on LinkedIn.
Write to us
Write to us with your setup, your problem and your deadline. Jean reads every message and answers it.