Apply a Realm Security Baseline
A 3-step recipe with Keycloak. We can help you get access.
Recipe · 3 steps
Apply a Realm Security Baseline
with Keycloak · Cybersecurity Management
Apply and verify a security baseline on a Keycloak realm.
- Snapshot the realm's current security settings before changing anything. This is the rollback record, and the before/after comparison that makes the change auditable.
- Apply the baseline in a single realm update: brute force protection with a growing lockout, SSL enforcement, the password policy, admin and login event logging, and tightened token and session lifespans. Realm update is a full-representatio
- Read the realm back and assert the controls persisted. An update that returns 204 while silently dropping a field is the failure mode this step exists to catch.
What you'll need to have ready
- realm: The name of the realm to harden.
- sslRequired: SSL enforcement level: all, external, or none. Use "all" for production and never "none" outside a local development realm.
- passwordPolicy: The realm password policy string (e.g. "length(12) and upperCase(1) and digits(1) and notUsername()").
- failureFactor: Number of failed login attempts before the account is temporarily locked.
- maxFailureWaitSeconds: Maximum lockout wait time in seconds.
- waitIncrementSeconds: How much the lockout wait grows after each additional failure.
- accessTokenLifespan: Access token lifespan in seconds. Shorter limits the blast radius of a leaked token.
- ssoSessionIdleTimeout: SSO session idle timeout in seconds.
- ssoSessionMaxLifespan: Maximum SSO session lifespan in seconds regardless of activity.
- bruteForceProtected: Whether to enable brute force detection on the realm.
- verifyEmail: Whether users must verify their email address.
For your developer
Arazzo workflow keycloak:harden-realm, 3 operations: getRealm → updateRealm → getRealm. Specs on APIs.io.