Grootan Foundations

Keycloak identity and access, set up properly and kept healthy

Grootan engineers design, build and operate Keycloak for single sign-on, user access and permissions, whether you are starting fresh or fixing a setup you already have.

Services

Our Keycloak services

Upgrading and Migrating Keycloak

We plan the route, rehearse the full cutover on a copy running alongside production, and have a tested rollback ready on the day.

Learn more

Use cases

Where it helps

Your first single sign-on

You want one login for all your applications and a single place to control access. We design it on Keycloak and build it.

A setup nobody looks after

It mostly works, but logins drag, old settings have stacked up and nobody claims it. We start with a review and can stay on to run it.

An overdue upgrade

Each release you skip makes the next upgrade bigger. We rehearse it on a copy and keep the old version ready to restore.

Time to leave a hosted IdP

Azure AD B2C, Okta, Auth0 or a login built in-house: your accounts and apps end up on Keycloak, moved in phases.

Sign-in that feels like your product

Branded screens, extra sign-in steps or accounts held in a database you already run, built so upgrades leave them intact.

Selling a B2B platform

Each customer brings separate users and a different way of signing in. We design a tenant model that holds up as you add more.

Not sure which of these fits? We'll work it out with you on a first call.

Process

How we work

  1. 01

    First conversation

    We learn which applications need sign-in, who your users are and what you want to change.

  2. 02

    Review and plan

    We study what you run today, or what you need, and hand you a written plan, ordered by priority, with the risks we see.

  3. 03

    Build or move

    We carry out the installation, upgrade or migration, test the result and keep a proven way to roll back.

  4. 04

    Keep it running

    If you would rather not do it yourselves, Grootan patches, monitors and supports Keycloak after launch.

Technologies

Technologies we work with

Identity standards

  • OpenID Connect
  • OAuth 2.0
  • SAML

Directories and sign-in

  • LDAP and Active Directory
  • Multi-factor authentication
  • WebAuthn and passkeys

Access control

  • Role-based access control (RBAC)
  • Automatic granting and removal of access
  • Access audit logs

Platform

  • Keycloak
  • Keycloak Organizations
  • HSM integration
  • Containers and Kubernetes

Grootan engineers are certified by AWS, Azure, MongoDB, Anthropic and Elasticsearch.

FAQ

Questions we hear

We already run Keycloak. Can you take it on?

Yes. Once we have assessed your hosting, realms, roles and clients, you decide with us which changes to make and which parts Grootan should operate.

Will an upgrade log our users out or break sign-in?

Not if the rehearsal does its job. Every integration and extension meets the new version on a copy before the real switch, and that switch only happens with a rollback ready.

Does Keycloak work with Active Directory?

Yes. People keep the username and password they already have, because Keycloak looks them up in Active Directory or LDAP.

We're on Azure AD B2C, Okta or Auth0. Is moving hard?

Not with a plan. Ours covers every account, connected app and login flow, and the aim is for most of your users not to notice the change.

Why pick Keycloak over a hosted identity service?

Three reasons. Your bill doesn't climb with your user count, because the software is open source. Most applications can connect to it, since it speaks SAML, OpenID Connect and OAuth 2.0. And you decide where it runs, so the identity data and configuration stay yours.

Let's get your sign-in on solid ground

Tell us what you're working on and we'll suggest where to start.