Keycloak Adaptive Authentication

• Change authentication requirements in real-time based on wider context
• Strengthen security - Require MORE factors when user attempt is suspicious or accessing sensitive resources
• Better User Experience - Require LESS factors when risk of fraudulent user is low
• Integration with remote services - For more information about the user or helping evaluating data via remote services
• Gather more information about user in a secure way
• Uses Risk-based authentication
• Uses AI services for more complex risk evaluations

Supported AI Engines

	OpenAI ChatGPT Default model: gpt-4o-mini
	Anthropic Claude Default model: claude-haiku-4-5-20251001
	Google Gemini (free tier available) Default model: gemini-2.5-flash-lite
	OpenRouter (extension) Model: set via OPENROUTER_API_MODEL
	IBM Granite (deprecated) Default model: granite-8b-code-instruct-128k

Risk is evaluated locally as much as possible. AI engines are only used for complex evaluations that require deeper contextual analysis. Since AI services are external dependencies, all user data (IP addresses, device info) is automatically anonymized before being sent to prevent information leakage. See Privacy and Anonymization Guide for details.

For more information and setup, see the AI Integration Guide.

Supported Keycloak Versions

Keycloak Version	Supported
26.7.x	Yes
26.6.x	Yes
26.5.x	Testing ended June 2026
main (nightly)	Yes

Getting Started

Build and try it out locally:

./mvnw clean install -DskipTests -Pbuild-distribution
./mvnw exec:exec@copy-extensions exec:exec@start-server

The generated JAR (core/target/keycloak-adaptive-authn-*.jar) can be added to the /providers folder of your Keycloak distribution with additional JARs as extensions from the /extensions module. The core JAR is also available as a Maven package:

<dependency>
    <groupId>io.github.mabartos</groupId>
    <artifactId>keycloak-adaptive-authn</artifactId>
    <version>${version}</version>
    <type>jar</type>
</dependency>

For full build instructions, installation options, and configuration, see the Start Guide.

Risk Evaluators

See EVALUATORS.md for a complete list of all built-in risk evaluators grouped by evaluation phase.

Resources with more info

1. Unlocking Adaptive Authentication (most recent)
   • Keycloak DevDay @ Darmstadt, Germany 2025
   • Slides
   • Talk
2. Adaptive Authentication
   • KeyConf24 @ Vienna, Austria 2024
   • Slides
   • Talk
   • Demo
3. AI-powered Keycloak
   • OpenShiftAI Roadshow @ Bratislava, Slovakia 2024
   • Slides
4. Adaptive Authentication
   • Master's thesis completed 2024
   • (Information might differ)
   • Document

Connected Authentication Policies

NOTE: Authentication policies that were part of this Adaptive authentication initiative were moved to repository mabartos/keycloak-authn-policies.