OAuth SIG (OAuth : Special Interest Group)

June 7, 2026 · View on GitHub

Ex FAPI-SIG (Financial-grade API Security : Special Interest Group)

Overview

FAPI-SIG is a group whose activity is mainly supporting Financial-grade API (FAPI) and its related specifications to keycloak.

FAPI-SIG is open to everybody so that anyone can join it anytime. Nothing special need not to be done to join it. Who want to join it can only access to the communication channels shown below. All of its activities and outputs are public so that anyone can access them.

FAPI-SIG mainly treats FAPI and its related specifications but not limited to. E.g., Ecosystems employing FAPI for their API Security like UK OpenBanking, Open Banking Brasil and Australia Consumer Data Right (CDR).

Since June 2023, FAPI-SIG is evolved into OAuth SIG. OAuth SIG will mainly treats OAuth/OIDC and its related security features like FAPI 2.0 to Keycloak.

Scope

Supporting OAuth/OIDC and its related security features to Keycloak.

Roles

Tech Lead : Takashi Norimatsu

Members

Please refer to the list.

Goals

Currently, proposed goals are as follows.

Nation/Region/Market Specific Features

  • EU : PSD2/eIDAS - QWAC Verification Extension

Open Works

Currently, proposed open works are as follows.

Contributions

FAPI related accomplishments by FAPI-SIG and OAuth SIG, other contributors and keycloak development team is as follows.​

Common Security Features

keycloak 14

keycloak 24

Nation/Region/Market Specific Features

keycloak 15

Standards​

keycloak 13

keycloak 14

keycloak 15

keycloak 18

keycloak 20

  • UK OpenBanking​ Security Profile

keycloak 23

keycloak 24

keycloak 25

Keycloak 26

In progress

OpenID for Verifiable Credentials
Format
Issuance Protocol
Other OpenID Connect Extension

Automated Conformance Test Run Environment by this kc-fapi-sig repository

The current environment uses the following software version.

  • Keycloak 26.6.3
  • Conformance-suite version : release-v5.1.43

FAPI 1.0 Advanced (Final)​

  • Client Authentication Method : MTLS, private_key_jwt​
  • Signature Algorithm : PS256, ES256​
  • Request Object Method : plain, PAR​
  • Response Mode : plain, JARM​

Keycloak 15.0.2 have achieved certification for all 8 conformance profiles of FAPI 1 Advanced Final (Generic).

FAPI-CIBA (Implementer’s Draft)​

  • Client Authentication Method : MTLS, private_key_jwt​
  • Signature Algorithm : PS256, ES256​
  • Mode : Poll, Ping

Keycloak 15.0.2 have achieved certification for all 4 conformance profiles of Financial-grade API Client Initiated Backchannel Authentication Profile (FAPI-CIBA).

Open Banking Brasil FAPI 1.0

  • Client Authentication Method : MTLS, private_key_jwt​
  • Signature Algorithm : PS256
  • Request Object Method : plain, PAR​
  • Response Mode : plain, JARM​

Keycloak 15.0.2 have achieved certification for 8 conformance profiles of Brazil Open Banking (Based on FAPI 1 Advanced Final) except for DCR (Dynamic Client Registration).

Open Finance Brasil FAPI 1.0 (Open Banking Brasil FAPI 1.0 was evolved)

  • Client Authentication Method : private_key_jwt​
  • Signature Algorithm : PS256
  • Request Object Method : PAR​
  • Response Mode : plain
  • ID token encryption : required

Australia Consumer Data Right (CDR)

  • Client Authentication Method : private_key_jwt​
  • Signature Algorithm : PS256
  • Request Object Method : plain, PAR​
  • Response Mode : plain, JARM​

Keycloak 15.0.2 have achieved certification for all 2 conformance profiles of Australia CDR (Based on FAPI 1 Advanced Final).

UK Open Banking

  • Client Authentication Method : MTLS, private_key_jwt​
  • Signature Algorithm : PS256
  • Request Object Method : plain, PAR​
  • Response Mode : plain

OpenID Connect: OpenID Providers

  • Basic OP
  • Implicit OP
  • Hybrid OP
  • Config OP
  • Dynamic OP
  • Form Post OP
  • 3rd Party-Init OP

Keycloak 18.0.0 have re-achieved certification for 6 conformance profiles of Certified OpenID Providers except for 3rd Party-Init OP.

OpenID Connect: OpenID Providers for Logout Profile

  • Front-Channel OP
  • Back-Channel OP
  • Session OP
  • RP-Initiated OP

Keycloak 18.0.0 have achieved certification for all 4 conformance profiles of Certified OpenID Providers for Logout Profiles.

Note: Session OP and Front-Channel OP of OpenID Provider for Logout Profile conformance tests cannot be automated. These can be passed manually.

FAPI 2.0 Security Profile Second Implementer’s Draft

  • FAPI2SP MTLS + MTLS
    • Client Authentication Method : mtls
    • Sender Constrain : mtls
    • OpenID : plain_oauth
    • FAPI Profile : plain​
  • FAPI2SP private key + MTLS
    • Client Authentication Method : private_key_jwt
    • Sender Constrain : mtls
    • OpenID : plain_oauth
    • FAPI Profile : plain​
  • FAPI2SP OpenID Connect
    • Client Authentication Method : mtls
    • Sender Constrain : mtls
    • OpenID : openid
    • FAPI Profile : plain​
  • FAPI2SP MTLS + DPoP
    • Client Authentication Method : mtls
    • Sender Constrain : dpop
    • OpenID : plain_oauth
    • FAPI Profile : plain​
  • FAPI2SP private key + DPoP
    • Client Authentication Method : private_key_jwt
    • Sender Constrain : dpop
    • OpenID : plain_oauth
    • FAPI Profile : plain​
  • FAPI2SP OpenID Connect (DPoP)
    • Client Authentication Method : mtls
    • Sender Constrain : dpop
    • OpenID : openid
    • FAPI Profile : plain​

FAPI 2.0 Message Signing First Implementer’s Draft

  • FAPI2MS JAR
    • Client Authentication Method : mtls
    • Sender Constrain : mtls
    • OpenID : plain_oauth
    • FAPI Profile : plain​
    • FAPI Request Method : signed_non_repudiation
    • FAPI Response Mode : plain_response
  • FAPI2MS JARM
    • Client Authentication Method : mtls
    • Sender Constrain : mtls
    • OpenID : plain_oauth
    • FAPI Profile : plain​
    • FAPI Request Method : signed_non_repudiation
    • FAPI Response Mode : jarm
  • FAPI2MS JAR (DPoP)
    • Client Authentication Method : mtls
    • Sender Constrain : dpop
    • OpenID : plain_oauth
    • FAPI Profile : plain​
    • FAPI Request Method : signed_non_repudiation
    • FAPI Response Mode : plain_response
  • FAPI2MS JARM (DPoP)
    • Client Authentication Method : mtls
    • Sender Constrain : dpop
    • OpenID : plain_oauth
    • FAPI Profile : plain​
    • FAPI Request Method : signed_non_repudiation
    • FAPI Response Mode : jarm

FAPI 2.0 Security Profile (Final)

  • FAPI2SP MTLS + MTLS
    • Client Authentication Method : mtls
    • Sender Constrain : mtls
    • OpenID : plain_oauth
    • FAPI Profile : plain​
  • FAPI2SP private key + MTLS
    • Client Authentication Method : private_key_jwt
    • Sender Constrain : mtls
    • OpenID : plain_oauth
    • FAPI Profile : plain​
  • FAPI2SP OpenID Connect
    • Client Authentication Method : mtls
    • Sender Constrain : mtls
    • OpenID : openid
    • FAPI Profile : plain​
  • FAPI2SP MTLS + DPoP
    • Client Authentication Method : mtls
    • Sender Constrain : dpop
    • OpenID : plain_oauth
    • FAPI Profile : plain​
  • FAPI2SP private key + DPoP
    • Client Authentication Method : private_key_jwt
    • Sender Constrain : dpop
    • OpenID : plain_oauth
    • FAPI Profile : plain​
  • FAPI2SP OpenID Connect (DPoP)
    • Client Authentication Method : mtls
    • Sender Constrain : dpop
    • OpenID : openid
    • FAPI Profile : plain​

FAPI 2.0 Message Signing (Final)

  • FAPI2MS JAR
    • Client Authentication Method : mtls
    • Sender Constrain : mtls
    • OpenID : plain_oauth
    • FAPI Profile : plain​
    • FAPI Request Method : signed_non_repudiation
    • FAPI Response Mode : plain_response
  • FAPI2MS JARM
    • Client Authentication Method : mtls
    • Sender Constrain : mtls
    • OpenID : plain_oauth
    • FAPI Profile : plain​
    • FAPI Request Method : signed_non_repudiation
    • FAPI Response Mode : jarm
  • FAPI2MS JAR (DPoP)
    • Client Authentication Method : mtls
    • Sender Constrain : dpop
    • OpenID : plain_oauth
    • FAPI Profile : plain​
    • FAPI Request Method : signed_non_repudiation
    • FAPI Response Mode : plain_response
  • FAPI2MS JARM (DPoP)
    • Client Authentication Method : mtls
    • Sender Constrain : dpop
    • OpenID : plain_oauth
    • FAPI Profile : plain​
    • FAPI Request Method : signed_non_repudiation
    • FAPI Response Mode : jarm

Passed Conformance Tests per Keycloak version

To ensure that every keycloak version can pass conformance tests, we check if a new Keycloak version pass conformance tests that the older Keycloak version could pass whenever the new Keycloak version is released.

We tagged the environment for every keycloak verion:

TagKeycloak versionConformance-suite version
kc-15.0.215.0.2release-v4.1.38
kc-17.0.017.0.0release-v4.1.41
kc-17.0.117.0.1release-v4.1.41
kc-18.0.018.0.0release-v4.1.42
kc-18.0.218.0.2release-v4.1.42
kc-19.0.119.0.1release-v4.1.45
kc-19.0.219.0.2release-v5.0.3
kc-20.0.020.0.0release-v5.0.6
kc-20.0.120.0.1release-v5.0.6
kc-20.0.220.0.2release-v5.0.7
kc-20.0.320.0.3release-v5.0.12
kc-20.0.520.0.5release-v5.0.14
kc-21.0.021.0.0release-v5.1.0
kc-21.0.121.0.1release-v5.1.0
kc-21.0.221.0.2release-v5.1.2
kc-21.1.021.1.0release-v5.1.2
kc-21.1.121.1.1release-v5.1.2
kc-21.1.221.1.2release-v5.1.5
kc-22.0.022.0.0release-v5.1.5
kc-22.0.122.0.1release-v5.1.5
kc-22.0.222.0.2release-v5.1.5
kc-22.0.322.0.3release-v5.1.7
kc-22.0.422.0.4release-v5.1.8
kc-22.0.522.0.5release-v5.1.9
kc-23.0.023.0.0release-v5.1.15
kc-23.0.123.0.1release-v5.1.15
kc-23.0.223.0.2release-v5.1.15
kc-23.0.323.0.3release-v5.1.15
kc-23.0.423.0.4release-v5.1.15
kc-23.0.523.0.5release-v5.1.15
kc-23.0.623.0.6release-v5.1.15
kc-23.0.723.0.7release-v5.1.15
kc-24.0.024.0.0release-v5.1.15
kc-24.0.124.0.1release-v5.1.15
kc-24.0.224.0.2release-v5.1.16
kc-24.0.324.0.3release-v5.1.16
kc-24.0.424.0.4release-v5.1.16
kc-24.0.524.0.5release-v5.1.16
kc-25.0.025.0.0release-v5.1.17
kc-25.0.125.0.1release-v5.1.17
kc-25.0.225.0.2release-v5.1.17
kc-25.0.425.0.4release-v5.1.21
kc-25.0.525.0.5release-v5.1.22
kc-25.0.625.0.6release-v5.1.22
kc-26.0.026.0.0release-v5.1.22
kc-26.0.126.0.1release-v5.1.22
kc-26.0.226.0.2release-v5.1.22
kc-26.0.426.0.4release-v5.1.22
kc-26.0.526.0.5release-v5.1.22
kc-26.0.626.0.6release-v5.1.25
kc-26.0.726.0.7release-v5.1.26
kc-26.0.826.0.8release-v5.1.28
kc-26.1.026.1.0release-v5.1.29
kc-26.1.126.1.1release-v5.1.30
kc-26.1.226.1.2release-v5.1.30
kc-26.1.326.1.3release-v5.1.30
kc-26.1.426.1.4release-v5.1.30
kc-26.1.526.1.5release-v5.1.31
kc-26.2.026.2.0release-v5.1.31
kc-26.2.126.2.1release-v5.1.31
kc-26.2.226.2.2release-v5.1.31
kc-26.2.326.2.3release-v5.1.31
kc-26.2.426.2.4release-v5.1.31
kc-26.2.526.2.5release-v5.1.32
kc-26.3.026.3.0release-v5.1.33
kc-26.3.126.3.1release-v5.1.33
kc-26.3.226.3.2release-v5.1.33
kc-26.3.326.3.3release-v5.1.36
kc-26.3.426.3.4release-v5.1.36
kc-26.3.526.3.5release-v5.1.36
kc-26.4.026.4.0release-v5.1.36
kc-26.4.126.4.1release-v5.1.37
kc-26.4.226.4.2release-v5.1.37
kc-26.4.426.4.4release-v5.1.37
kc-26.4.526.4.5release-v5.1.37
kc-26.4.626.4.6release-v5.1.37
kc-26.4.726.4.7release-v5.1.37
kc-26.5.026.5.0release-v5.1.39
kc-26.5.126.5.1release-v5.1.39
kc-26.5.226.5.2release-v5.1.39
kc-26.5.326.5.3release-v5.1.39
kc-26.5.426.5.4release-v5.1.39
kc-26.5.526.5.5release-v5.1.39
kc-26.5.626.5.6release-v5.1.39
kc-26.5.726.5.7release-v5.1.41
kc-26.6.026.6.0release-v5.1.41
kc-26.6.126.6.1release-v5.1.41
kc-26.6.226.6.2release-v5.1.43
kc-26.6.326.6.3release-v5.1.43
Keycloak versionFAPI 1.0 AdvancedFAPI-CIBAOpen Banking Brasil FAPI 1.0 (*1,*2),*15Open Finance Brasil FAPI 1.0 (*3)Australia Consumer Data Right (CDR) (*8)UK Open BankingOpenID Connect OP (*4)OpenID Connect OP for Logout ProfileFAPI 2.0 Security Profile Implementer’s Draft (*6,*14)FAPI 2.0 Message Signing Implementer’s Draft (*6,*14)FAPI 2.0 Security Profile (*9)FAPI 2.0 Message Signing (*9)
15.0.2xxx-x-------
17.0.0xxx-x-------
17.0.0-legacyxxx-x-------
17.0.1xxx-x-------
17.0.1-legacyxxx-x-------
18.0.0xxx-x-xx----
18.0.0-legacyxxx-x-xx----
18.0.2xxx-x-xx----
18.0.2-legacyxxx-x-xx----
19.0.1xxx-x-xx----
19.0.1-legacyxxx-x-xx----
19.0.2xxx-x-xx----
19.0.2-legacyxxx-x-xx----
20.0.0xxx-xxxx----
20.0.1xxx-xxxx----
20.0.2xxx-xxxx----
20.0.3xxx-xxxx----
20.0.5xxx-xxxx----
21.0.0xxx-xxxx----
21.0.1xxx-xxxx----
21.0.2xxx-xxxx----
21.1.0xxx-xxxx----
21.1.1xxx-xxxx----
21.1.2xxx-xxxx----
22.0.0xxx-xxxx----
22.0.1xxx-xxxx----
22.0.2xxx-xxxx----
22.0.3xxx-xxxx----
22.0.4xxx-xxxx----
22.0.5xxx-xxxx----
23.0.0xx-(*5)-(*5)xxxxxx--
23.0.1xxxxxxxxxx--
23.0.2xxxxxxxxxx--
23.0.3xxxxxxxxxx--
23.0.4xxxxxxxxxx--
23.0.5xxxxxxxxxx--
23.0.6xxxxxxxxxx--
23.0.7xxxxxxxxxx--
24.0.0xxxxxxxxxx--
24.0.1xxxxxxxxxx--
24.0.2xxxxxxxxxx--
24.0.3xxxxxxxxxx--
24.0.4xxxxxxxxxx--
24.0.5xxxxxxxxxx--
25.0.0xxxxxxxxxx--
25.0.1xxxxxxxxxx--
25.0.2xxxxxxxxxx--
25.0.4xxxxxxxxxx--
25.0.5xxxxxxxxxx--
25.0.6xxxxxxxxxx--
26.0.0xxxxxxxxxx--
26.0.1xxxxxxxxxx--
26.0.2xxxxxxxxxx--
26.0.4xxxxxxxxxx--
26.0.5xxxxxxxxxx--
26.0.6xxxxxxxxxx--
26.0.7xxxxxxxxxx--
26.0.8xxxxxxxxxx--
26.1.0xxxxxxxxxx--
26.1.1xxxxxxxxxx--
26.1.2xxxxxxxxxx--
26.1.3xxxxxxxxxx--
26.1.4xxxxxxxxxx--
26.1.5xxxxxxxxxx--
26.2.0xxxxxx-(*7)xxx--
26.2.1xxxxxx-(*7)xxx--
26.2.2xxxxxx-(*7)xxx--
26.2.3xxxxxxxxxx--
26.2.4xxxxxxxxxx--
26.2.5xxxxxxxxxx--
26.3.0xxxxxxxxxxx(*10)x(*11)
26.3.1xxxxxxxxxxx(*10)x(*11)
26.3.2xxxxxxxxxxx(*10)x(*11)
26.3.3xxxxxxxxxxx(*10)x(*11)
26.3.4xxxxxxxxxxx(*10)x(*11)
26.3.5xxxxxxxxxxx(*10)x(*11)
26.4.0x(*12)x(*12)(*13)x(*12)x(*12)x(*12)x(*12)xxx(*12)x(*12)x(*12)x(*12)
26.4.1xxxxxxxxxxxx
26.4.2xxxxxxxxxxxx
26.4.4xxxxxxxxxxxx
26.4.5xxxxxxxxxxxx
26.4.6xxxxxxxxxxxx
26.4.7xxxxxxxxxxxx
26.5.0xx-xxx-(*16)x--xx
26.5.1xx-xxx-(*16)x--xx
26.5.2xxxxxxxxxxxx
26.5.3xxxxxxxxxxxx
26.5.4xxxxxxxxxxxx
26.5.5xxxxxxxxxxxx
26.5.6xxxxxxxxxxxx
26.5.7xxxxxxxxxxxx
26.6.0xxxxxxxxxxxx
26.6.1xxxxxxxxxxxx
26.6.2xxxxxxxxxxxx
26.6.3xxxxxxxxxxxx

Note: Keycloak legacy (wildfly) is no longer supported since keycloak 20.

*1 : Up to Implementer's Draft version 2, Open Banking Brazil Security Profile. From Implementer's Draft version 3, Open Finance Brazil Security Profile. Its conformance test is no longer supported since conformance suite version 5.1.11. Therefore, its conformance test is conducted by the conformance suite version 5.1.10.

*2 : Its conformance test is supported by conformance suite version 5.1.11.

*3 : Except for Dynamic Client Registration (DCR) conformance profile.

*4 : Except for 3rd Party-Init OP conformance profile.

*5 : ISSUE-25022

*6 : Since keycloak 26.1.0, the FAPI2 with DPoP conformance tests are also passed (FAPI2SP MTLS + DPOP, FAPI2SP private key + DPOP).

*7 : ISSUE-39037

*8 : According to Australia CDR security profile specification, From May 12th 2025, JARM is mandatory, and it seems that the conformance suite from v5.1.33 only accepts the "AU-CDR Adv. OP w/ Private Key, PAR, JARM" conformance profile while the current Conformance Test Execution Platform can run the "AU-CDR Adv. OP w/ Private Key" and "AU-CDR Adv. OP w/ Private Key, PAR" conformance profile tests. Therfore, from the conformance suite version v5.1.33, it only tests "AU-CDR Adv. OP w/ Private Key, PAR, JARM" conformance profile.

*9 : Since conformance suite version 5.1.33, FAPI 2.0 Security Profile Final and Message Signing Final conformance test is supported.

*10 : Due to ISSUE-41119, Keycloak can pass some conformance tests among the five conformance profiles' conformance tests of FAPI 2.0 Serurity Profile Final specification:

  • FAPI2SP MTLS + MTLS: passed
  • FAPI2SP MTLS + DPOP: passed
  • FAPI2SP private key + MTLS: not passed
  • FAPI2SP private key + DPOP: not passed
  • FAPI2SP OpenID Connect: passed (if not using private_key_jwt as client authentication method)

*11 : Due to ISSUE-41119, , Keycloak can pass some conformance tests among the two conformance profiles' conformance tests of FAPI 2.0 Message Signing Final specification:

  • FAPI2MS JAR: passed (if not using private_key_jwt as client authentication method)
  • FAPI2MS JARM: passed (if not using private_key_jwt as client authentication method)

*12 : Due to ISSUE-43269, Keycloak cannot pass the following conformance tests:

  • FAPI 1.0 Advanced Final (w/ private_key_jwt as client authentication method)
  • FAPI 2.0 Security Profile Final (w/ private_key_jwt as client authentication method)
  • FAPI 2.0 Message Signing Final (w/ private_key_jwt as client authentication method)
  • FAPI 2.0 Security Profile Implementer’s Draft version 2 (w/ private_key_jwt as client authentication method)
  • FAPI 2.0 Message Signing Implementer’s Draft version 1 (w/ private_key_jwt as client authentication method)
  • FAPI-CIBA (w/ private_key_jwt as client authentication method)
  • UK Open Banking (w/ private_key_jwt as client authentication method)
  • Australia Consumer Data Right (w/ private_key_jwt as client authentication method)
  • Open Finance Brazil (w/ private_key_jwt as client authentication method)

while Keycloak still can pass the following conformance tests:

  • FAPI 1.0 Advanced Final (w/ mtls as client authentication method)
  • FAPI 2.0 Security Profile Final (w/ mtls as client authentication method)
  • FAPI 2.0 Message Signing Final (w/ mtls as client authentication method)
  • FAPI 2.0 Security Profile Implementer’s Draft version 2 (w/ mtls as client authentication method)
  • FAPI 2.0 Message Signing Implementer’s Draft version 1 (w/ mtls as client authentication method)
  • FAPI-CIBA (w/ mtls as client authentication method)
  • UK Open Banking (w/ mtls as client authentication method)
  • Open Finance Brazil (w/ mtls as client authentication method)

*13 : Due to ISSUE-43270, Keycloak cannot pass the following conformance tests:

  • FAPI-CIBA (w/ private_key_jwt as client authentication method)

while Keycloak still can pass the following conformance tests:

  • FAPI-CIBA (w/ mtls as client authentication method)

*14 : FAPI 2.0 final version was released. Therefore, FAPI 2.0 draft version conformance is no longer checked.

*15 : Open Finance Brasil, the successor of Open Banking Brasil was relased. Therefore, Open Banking Brasil is no longer checked.

*16 : ISSUE-45250

Other Contributions

Hosting Conferences

Keyconf 26 (Holiday Inn Prague, Prague, Czech Republic, October 8, 2026)

Keyconf 25 (Van der Valk Hotel Amsterdam Zuidas – RAI, Amsterdam, Netherlands, August 28, 2025)

Keyconf 24 (ARCOTEL Kaiserwasser Wien, Vienna, Austria, September 19, 2024)

Keyconf 23 (Level39, London, United Kingdom, June 16, 2023)

Conference Speech

Keyconf 25 (Van der Valk Hotel Amsterdam Zuidas – RAI, Amsterdam, Netherlands, August 28, 2025)

  • Title: Keycloak & OpenID Federation: Empowering Dynamic Trust in Federated Environments
  • Title: Keycloak meets AI: the possibility of integrating Keycloak with AI
  • URL: https://keyconf.dev/

Open Source Summit Europe 2025 (RAI Amsterdam Convention Centre, Amsterdam, Netherlands, August 25, 2025)

KubeCon + CloudNativeCon Japan 2025 (Hilton Tokyo Odaiba Hotel, Tokyo, Japan, June 16, 2025)

KeycloakCon Japan 2025 (Hilton Tokyo Odaiba Hotel, Tokyo, Japan, June 13, 2025)

KubeCon + CloudNativeCon Europe 2025 (Excel London, London, United Kingdom, April 4, 2025)

Keycloak DevDay 2025 (greet Hotel Darmstadt, Germany, Darmstadt, March 6, 2025)

  • Title: Enhancing Group Management in Keycloak: A Flexible Extension for Dynamic Membership Control
  • Title: Keycloak's Compliance with Security Specifications : from OAuth 2.0, OIDC to OID4VCI
  • Title: Mastering Access Control: Low-Code Authorization with ReBAC, Decoupling Patterns and Policy as Code
  • Title: Strengthening Security in Keycloak: An Introduction to the Shared Signals Framework
  • URL: https://www.keycloak-day.dev/

OAuth Security Workshop 2025 (Harpa Concert Hall and Conference Centre, Iceland, Reykjavík, February 27, 2025)

FOSDEM 2025 (Université Libre de Bruxelles Campus du Solbosch, Belgium, Brussels, February 1, 2025)

Keyconf 24 (ARCOTEL Kaiserwasser Wien, Vienna, Austria, September 19, 2024)

  • Title: The Journey, Achievements, and Significance of the Keycloak SIG Community
  • Title: Streamlining Keycloak Configuration Management: Exploring keycloak-config-cli
  • Title: Keycloak's Updates on Emerging Paradigm of Identity and Compliance with Security Specifications
  • Title: Core Keycloak features developed in past 12 months
  • Title: Integrating Keycloak with Openresty as a resource server in Open Banking
  • Title: New and Noteworthy in the OAuth World
  • URL: https://keyconf.dev/2024/

Open Source Summit Europe 2024 (Austria Centre Vienna, Vienna, Austria, September 18, 2024)

OAuth Security Workshop 2024 (Auditorium Antonianum, Rome, Italy, April 11, 2024)

KubeCon + CloudNativeCon Europe 2024 (Paris Expo Porte de Versailles, Paris, France, March 22, 2024)

OpenID Summit Tokyo 2024 (Shibuya Stream Hall, Tokyo, Japan, January 19, 2024)

KubeCon + CloudNativeCon North America 2023 (McCormick Place West, Chicago, Illinois, United States of America, November 7, 2023)

Keyconf 23 (Level39, London, United Kingdom, June 16, 2023)

  • Title: Recently added features in Keycloak in past years that make Keycloak a strong performer in the IAM marke
  • Title: OpenID FAPI work in the last 12 months
  • Title: Keycloak in Open Banking or consent-driven open data ecosystem
  • Title: OpenID FAPI presentation
  • Title: Roadmap on possible ideas for the future work of Keycloak
  • URL: https://www.eventbrite.co.uk/e/keyconf-23-tickets-621079815447

Apidays Paris 2022 (Cité des sciences et de l'industrie, Paris, France, December 6, 2022)

OAuth Security Workshop 2021 (Virtual Event, December 1, 2021)

PhD Dissertation

Referred academic paper

Developing the Flexible Conformance Test Execution Platform for OAuth 2.0-based Security Profiles

Policy-Based Method for Applying OAuth 2.0-Based Security Profiles

Oral presentation of refereed international conference paper

Flexible Method for Supporting OAuth 2.0 Based Security Profiles in Keycloak

Communication Channels

Not only OAuth SIG member but others can communicate with each other by the following ways.

Automated Conformance Test Run Environment

Please see conformance-tests-env.

License