Platform · Extensions
Extend Keycloak without forking it
When the built-in features stop short, we add what you need through Keycloak's Service Provider Interfaces — vetting community extensions, writing custom SPIs, and shipping them in a reproducible image that keeps working when you upgrade.
- Custom SPIs written and tested
- Security-reviewed community extensions
- Checked against each Keycloak release
Standards & integrations
- Keycloak SPIs
- Java / Quarkus
- Maven
- OCI container images
- Testcontainers
- GitHub Actions / GitLab CI
Overview
Extending Keycloak the maintainable way
Keycloak is built to be extended: authentication steps, event handling, user storage, token mappers, required actions and themes are all pluggable through SPIs. The risk isn't writing an extension — it's the one nobody owns, pulled from an abandoned repository, that blocks your next upgrade. We keep extensions few, reviewed, tested and versioned alongside the Keycloak release they run on.
What we deliver
- Extension inventory with adopt, fork or replace recommendations
- Custom SPI source code in your repository
- Unit and integration test suites for each extension
- Security and licence review of third-party extensions
- Custom Keycloak image built and versioned in CI
- Upgrade compatibility checklist for each Keycloak release
Capabilities
What Extensions covers
Configured, tested and documented on upstream Keycloak — then handed over or operated by us.
Custom authenticators
Authentication steps Keycloak doesn't ship — a call to your fraud service, a legacy token check, a device posture lookup — built as authenticators and placed in your login flows.
Event listeners
Login and admin events streamed to Kafka, a SIEM or a webhook, so identity activity feeds the systems your security and product teams already use.
User storage providers
Users federated from a legacy database or in-house directory, either queried live or migrated into Keycloak on the fly as they sign in.
Mappers and required actions
Custom claims computed at token time, and custom steps users must complete — such as confirming details held in another system — when the built-in options don't fit.
Community extensions, vetted
Before a third-party extension goes near production, we check its licence, maintenance activity, code and dependencies — then decide whether to adopt, fork or rebuild it.
Reproducible Keycloak image
Extensions and themes are built into a versioned container image with Keycloak's build step run ahead of time, so every environment runs exactly the same bits.
How it works
From first call to production
Confirm an extension is needed
We first check whether configuration, a built-in authentication flow or an existing feature already covers the requirement. Custom code is the last resort, not the first.
Build or vet, with tests
Custom SPIs are written against Keycloak's APIs with unit and container-based integration tests; community extensions get a licence, security and maintenance review.
Package, deploy and keep compatible
Everything ships in one custom image through CI. Before each Keycloak upgrade, the extension test suite runs against the new release so breaking SPI changes surface early.
Use cases
Where teams put it to work
Integrating with in-house systems
Sign-in that consults your fraud, CRM or entitlement service at the right step of the flow, without bolting that logic onto every application.
Migrating from a legacy user store
Users keep their existing passwords while they're moved into Keycloak on first login, so the old database can be retired without a forced reset.
Replacing unmaintained plugins
An extension that's holding back your upgrade is reviewed, then replaced with a built-in feature or a maintained rewrite you control.
FAQ
Extensions questions, answered
Will custom extensions break when we upgrade Keycloak?
They can, because many Keycloak SPIs are internal and change between releases. That's why every extension we maintain has tests we run against the next Keycloak version before you upgrade, and why we prefer built-in features wherever they exist.
Are community extensions safe to use?
Some are well maintained and some aren't. We review licence, recent activity, open issues, code quality and dependencies, and pin exact versions rather than pulling the latest release into production.
How are extensions deployed?
Provider JARs are added to Keycloak's providers directory in a custom container image, and Keycloak's build step runs when the image is built. The result is a single versioned image promoted across environments.
Who owns the code you write?
You do. Custom SPIs live in your repository with build scripts, tests and documentation, so your team can maintain them without us.
Ready to roll out Extensions?
Walk us through your requirements on a free strategy call. We'll come back with an architecture, a delivery plan and a fixed scope.