Identity and access
Keycloak and Auth0, the migrations between them, and the access model underneath.
Most identity work is not a greenfield build. It is a live user base, a provider that no longer fits, and a deadline that belongs to someone else. We work on that, alongside the team that owns it.
- Keycloak
- Auth0
- OIDC
- SAML
- Kubernetes
- Terraform
- Pulumi
- Datadog
Three million accounts, thirty microservices.
- Client
- Optical retail and omnichannel commerce, Germany
- Scope
- Keycloak to Auth0, 3M+ users, 30+ microservices
- Platform
- Keycloak on Kubernetes, v15 to v24
- Events
- Auth0 to AWS EventBridge, via Lambda
- Tooling
- Datadog, Pulumi, Terraform
- Our role
- A key role alongside the client’s own engineering team
The client’s name is withheld by contract. Everything else is what was built.
Where we come in.
You are moving off Keycloak, or onto it.
Both directions are ordinary work, and both go wrong in the same place: the parts of the old system nobody wrote down. We map what the current provider actually does, the token claims other services read, the custom flows, the scripts that run at login, before anything moves.
Keycloak has to do something Keycloak does not do.
Past a certain size every serious deployment extends it: custom authenticators, required actions, token mappers, a storage provider reading a system that already holds your users. We have written these, and we know which of them keep working after an upgrade. That is what decides your next one, because an extension bound to Keycloak internals is a version you can never leave.
A customer wants to bring their own identity provider.
Enterprise agreements arrive with an identity requirement attached: SAML, OIDC, their directory, their rules. We set up the federation, the claim mapping and the account linking, so that the tenth one is configuration rather than a project.
The access model has outgrown a list of roles.
More roles will not fix it. What does is deciding whether access is a property of the user, the resource, or the relationship between them, then writing that down where the application can read it. We do that with the team who will maintain it.
When to bring us in.
- While the migration is still a plan. Scoping is where the cost is decided.
- When an upgrade crosses several major versions at once.
- When an agreement requires single sign-on you have not built yet.
Tell us what you are building.
We work in German and English. Our clients are across the DACH region and the EU, more than seven of them since 2022.