Keycloak

Workflow

1. Confirm identity domains and realm boundaries.
2. Model clients by app type and trust level.
3. Enforce secure redirect URI and flow settings.
4. Configure scopes, protocol mappers, and claims intentionally.
5. Tune token/session lifetimes and logout behavior.
6. Harden admin/API access and key lifecycle.
7. Validate failover, backup, and upgrade procedures.

Preflight (Ask / Check First)

• Keycloak version and distribution mode.
• Realm topology (single vs multi-realm).
• Public, confidential, and service-account client mix.
• Required claims and role/group model.
• Regulatory and audit constraints.