Keycloak

Connect Keycloak to collect identity & sso evidence automatically.

Connect with an API token

1. In Keycloak:

   1. In the Keycloak Admin Console, select the realm Safeguard should read and click Clients.
   2. Click Create client, enter a Client ID (for example safeguard-reader), and click Next.
   3. Turn Client authentication On, check Service accounts roles, and click Save.
   4. Open the client's Credentials tab and copy the Client Secret.
   5. On the client, select the Service account roles tab and click Assign role.
   6. Choose Filter by clients, select the realm-management view roles (view-users, view-realm, and other view-* roles you want collected), and confirm the assignment.

   Where to find the other values:

   • Keycloak base URL: The address of your Keycloak server: the part of the Admin Console URL before /admin/ (for example http://localhost:8080 when the Admin Console is at http://localhost:8080/admin/).
   • Realm: The name of the realm Safeguard should read; click Current realm in the Admin Console to see the realms you can manage.
   • Service account client ID: The Client ID you entered when creating the client (also listed under Clients).

   The client secret stays viewable on the Credentials tab. The optional admin bearer token is a short-lived alternative that stops collection when it expires; prefer the service-account client.

   Source: keycloak.org, checked 2026-10-07.

2. On Compliance › Connectors, open Keycloak, click Connect, choose API token and fill in:

   Field	What to enter
   Keycloak base URL	Required. Include the context path if you have one, e.g. https://idp.example.com/idp
   Realm	Required.
   Service account client ID	Optional. A confidential client with Service Accounts enabled and the realm-management view roles.
   Client secret	Optional. Stored encrypted and never shown again.
   Admin bearer token (optional)	Alternative to a service account. Expires quickly, so collection stops when it does. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Keycloak and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Identity & SSO connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks