Finding Your Way Around Keycloak

Chapter I

Keycloak is a large multi-module Maven (Java) project plus a set of JS frontends, built around a plugin architecture: nearly every capability (storage, authentication, protocols, crypto) is expressed as a Service Provider Interface (SPI) that different modules implement. Start from the request path — a browser or app hits the REST/protocol layer in services, which delegates to pluggable authenticators and providers looked up through KeycloakSession — and branch out from there into persistence, federation, and authorization as needed.

Keycloak request flow and module architecture

Admin & Account Consoles (js/apps)…pps/admin-ui/src/admin-client.tsx

Protocol & Login Endpoints (services)…ces/resources/RealmsResource.java

Quarkus Distribution Runtime (quarkus)…quarkus/runtime/KeycloakMain.java

Admin REST API (AdminRoot)…es/resources/admin/AdminRoot.java

Authentication Flow Engine…tion/AuthenticationProcessor.java

Authorization Services (authz)…zation/AuthorizationProvider.java

Server SPI (Provider / KeycloakSession)…g/keycloak/provider/Provider.java

Model Persistence (model/jpa, model/infinispan)…loak/models/jpa/RealmAdapter.java

User Federation (federation/ldap, kerberos, ...)…/storage/UserStorageProvider.java

Figure I · Click a node to see what it does, where it lives in the code, and its labeled connections — the annotation opens beside it.