Identities and Authentication for your Agents with Keycloak

AI agents and agentic workflows revolutionize the way we build applications, and the market is expanding rapidly. One of the developing standards of this integration is MCP.

Keycloak supports the authorization part of MCP. In this session, we will introduce the different versions of MCP, the capabilities of Keycloak, and show you how to configure Keycloak for using is as an authorization server for agents.

Transcript

1. Identities and Authentication for your Agents with Keycloak 2026-07-29 Takashi Norimatsu Alexander Schwartz Keycloak Maintainer Hitachi, Ltd. Keycloak Maintainer IBM
2. Contents 1. Identity in the age of AI 2. Overview over Keycloak’s AI related capabilities 3. MCP versions and their support in Keycloak 4. MCP OAuth 2.1 with Enterprise Managed Authorization 5. AI Tools integration including demo 6. Status and outlook for AI Identity with Keycloak
3. 1. Identity in the age of AI
4. Identity in the age of AI The paradigm shift to a world of autonomous agents We are moving from Human-to-Machine interactions to a world of Autonomous AI Agents. Machine-to-Machine (M2M) is the new default. Static API keys and too broad permissions are the biggest vulnerability. Identity must be dynamic, short-lived, and verifiable.
5. 2. Overview over Keycloak’s AI related capabilities
6. Overview over Keycloak’s AI related capabilities Cloud-native platform identity as the root of trust AI workloads don't need passwords. They use one of the following infrastructure-backed identities to authenticate: • SPIFFE: Cryptographic, platform-agnostic identity via SVIDs • Kubernetes Service Accounts: Native container identity Keycloak acts as the Token Broker, exchanging these for OAuth 2.0 Access Tokens. https://datatracker.ietf.org/doc/draft-ietf-oauth-spiffe-client-auth/ or
7. Overview over Keycloak’s AI related capabilities Chaining human identity with agent identity RFC 8693 token exchange allows creating tokens that reference the human and the agent. 1. 2. 3. The human user's context (OIDC ID Token) provides the original intent and authorization. The Identity Provider swaps the user token for a Scoped Token specifically for the AI Agent with the correct audience. The resulting JWT contains the act claim, linking the human user to the acting agent bound for a specific audience. Works for multiple hops for subsequent calls to for example an MCP server. https://www.keycloak.org/securing-apps/token-exchange 1 2 3
8. Overview over Keycloak’s AI related capabilities RFC 8693 token exchange in practice # Exchange human token for agent token curl -X POST "https://keycloak/.../token" \ "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \ -d "subject_token=$USER_OR_SCOPED_JWT" \ -d "audience=mcp-data-server" \ -d "scope=mcp:resources" // Scoped token { "sub": "user_123", "aud": “my-mcp-server", "act": { "sub": “my-agent” } } https://www.keycloak.org/securing-apps/token-exchange
9. Overview over Keycloak’s AI related capabilities Authentication across organization boundaries with ID-JAG Identity Assertion JWT Authorization Grant enables secure agent interaction across enterprise boundaries. Federation: Allow internal agents to call external enterprise MCP servers without extra logins. Just in time: Tokens are minted for specific tasks and expire immediately after the context closes. Auditability: Domain B can verify Domain A's signature to trust the agent's identity assertion. This is an experimental feature in Keycloak. https://github.com/keycloak/keycloak/issues/43971
10. Overview over Keycloak’s AI related capabilities External Policy Decision with AuthZEN AI agents shouldn't hardcode logic. OpenID AuthZen provides a standard API for: Separation of Concerns: PEP (Agent, MCP, Gateway) asks, PDP (Keycloak) decides. Interoperability: Switch policy engines without changing agent code. Runtime Evaluation: "Can this agent access this document now?“ This is an experimental feature in Keycloak. https://www.keycloak.org/nightly/securing-apps/authzen-authorization https://www.keycloak.org/2026/05/authzen-as-experimental-feature
11. Overview over Keycloak’s AI related capabilities AuthZEN in action POST /realms/{realm}/authzen/access/v1/evaluation Authorization: Bearer <access-token> Content-Type: application/json { "subject": { "type": "user", "id": "alice" }, "resource": { "type": "document", "id": "quarterly-report" }, "action": { "name": "read" } } { "decision": true }
12. 3. MCP versions and their support in Keycloak
13. KubeCon + CloudNativeCon 2026 MCP Authorization Standards Compliance*1 Standard 2025-11-25 2025-06-18 2025-03-26 Keycloak 26.7 The OAuth 2.1 Authorization Framework (Internet Draft) MUST MUST MUST Supported OAuth 2.0 Authorization Server Metadata (RFC 8414) MUST MUST MUST Supported Resource Indicators for OAuth 2.0 (RFC 8707) MUST? MUST? - Not supported (In progress) OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591) MAY SHOULD SHOULD Supported OAuth Client ID Metadata Document (Internet Draft) SHOULD - - Supported (Experimental) MCP Version Keycloak 26.7 2025-03-26 Supported 2025-06-18 Partially Supported without Resource Indicators for OAuth 2.0 (workaround exists) 2025-11-25 Partially Supported without Resource Indicators for OAuth 2.0 (workaround exists) 12 *1: https://www.keycloak.org/securing-apps/mcp-authz-server Identities and Authentication for your Agents with Keycloak ©Hitachi, Ltd. 2026. All rights reserved
14. KubeCon + CloudNativeCon 2026 MCP Authorization Standards Compliance (plan) Standard 2025-11-25 2025-06-18 2025-03-26 Keycloak 26.8 The OAuth 2.1 Authorization Framework (Internet Draft) MUST MUST MUST Supported OAuth 2.0 Authorization Server Metadata (RFC 8414) MUST MUST MUST Supported Resource Indicators for OAuth 2.0 (RFC 8707) MUST? MUST? - Supported (Experimental) OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591) MAY SHOULD SHOULD Supported OAuth Client ID Metadata Document (Internet Draft) SHOULD - - Supported (Preview) MCP Version Keycloak 26.8 2025-03-26 Supported 2025-06-18 Supported 2025-11-25 Supported 2026-07-28 (maybe) Supported 13 Identities and Authentication for your Agents with Keycloak ©Hitachi, Ltd. 2026. All rights reserved
15. KubeCon + CloudNativeCon 2026 MCP Authorization Extensions*1 Standards Compliance Standard MCP EnterpriseIdentity Assertion *2 managed Authorization JWT Authorization (EMA) Grant*4 (Stable) (Internet Draft) OAuth Client Credentials Extension*3 (Draft) Keycloak 26.7 as Resource Authorization Server (AS) Supported (Experimental) as IdP Authorization Server (IdP) Not supported (In Progress) Not supported*5 *1: https://github.com/modelcontextprotocol/ext-auth/ *2: https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/stable/enterprise-managed-authorization.mdx *3: https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/oauth-client-credentials.mdx *4: https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-04.html *5: not support “resource” parameter in client credentials grant 14 Identities and Authentication for your Agents with Keycloak ©Hitachi, Ltd. 2026. All rights reserved
16. KubeCon + CloudNativeCon 2026 MCP Authorization Extensions Standards Compliance (plan) Standard MCP Enterprisemanaged Authorization (EMA) (Stable) Keycloak 26.8 Identity Assertion JWT Authorization Grant (Internet Draft) OAuth Client Credentials Extension (Draft) 15 Identities and Authentication for your Agents with Keycloak as Resource Authorization Server (AS) Supported (Experimental) as IdP Authorization Server (IdP) Supported (Experimental) ? ©Hitachi, Ltd. 2026. All rights reserved
17. 4. MCP OAuth 2.1 with Enterprise Managed Authorization
18. KubeCon + CloudNativeCon 2026 MCP: OAuth 2.1 Authorization AS Keycloak 1.OAuth 2.1 User Consent Agent 2.Access MCP Server MCP Client API Server : Access token for MCP Server 17 Identities and Authentication for your Agents with Keycloak ©Hitachi, Ltd. 2026. All rights reserved
19. KubeCon + CloudNativeCon 2026 MCP: OAuth 2.1 Authorization AS Keycloak 1.OAuth 2.1 User Consent Agent MCP Server MCP Client 2.Access API Server : Access token for API Server 18 Identities and Authentication for your Agents with Keycloak ©Hitachi, Ltd. 2026. All rights reserved
20. KubeCon + CloudNativeCon 2026 MCP EMA: Identity Assertion JWT Authorization Grant (ID-JAG) IdP OIDC / OAuth 2.1 User Login MCP Server ID Agent MCP Client API Server AS ID : ID token 19 Identities and Authentication for your Agents with Keycloak Keycloak ©Hitachi, Ltd. 2026. All rights reserved
21. KubeCon + CloudNativeCon 2026 MCP EMA: Identity Assertion JWT Authorization Grant (ID-JAG) IdP 1.Token Exchange ID User Agent No interaction 3.Access MCP Server MCP Client API Server 2.ID-JAG : Access token for MCP Server : ID-JAG for an access token for MCP Server ID : ID token 20 Identities and Authentication for your Agents with Keycloak AS Keycloak ©Hitachi, Ltd. 2026. All rights reserved
22. KubeCon + CloudNativeCon 2026 MCP EMA: Identity Assertion JWT Authorization Grant (ID-JAG) IdP 1.Token Exchange ID User Agent No interaction MCP Server MCP Client 3.Access API Server 2.ID-JAG : Access token for API Server : ID-JAG for an access token for API Server ID : ID token 21 Identities and Authentication for your Agents with Keycloak AS Keycloak ©Hitachi, Ltd. 2026. All rights reserved
23. 5. AI Tools integration including demo
24. KubeCon + CloudNativeCon 2026 AI Tools Integration https://vscode.dev/oauth/ client-metadata.json VS Code Claude Code Bearer Token Usage Server example of mcp/typescript-sdk Scope: mcp:tools VS Code Claude Code 23 Identities and Authentication for your Agents with Keycloak MCP Server Token Introspect Bearer Token Usage VS Code Metadata OAuth 2.1 Authorization AS Keycloak 26.7 CIMD OAuth 2.1 Authorization https://claude.ai/oauth/ claude-code-client-metadata Claude Code Metadata ©Hitachi, Ltd. 2026. All rights reserved
25. KubeCon + CloudNativeCon 2026 Demo 24 Identities and Authentication for your Agents with Keycloak ©Hitachi, Ltd. 2026. All rights reserved
26. 6. Status and outlook for AI Identity with Keycloak
27. KubeCon + CloudNativeCon 2026 Milestones v26.2 Secret-less Workload Identity v26.5 preview v26.6 v26.7 supported Federated Client Authentication preview OAuth SPIFFE Client Authentication preview JWT Authorization Grant Delegation Chaining supported supported Token Exchange Identity and Authorization Chaining Across Domains 26 Identities and Authentication for your Agents with Keycloak ©Hitachi, Ltd. 2026. All rights reserved
28. KubeCon + CloudNativeCon 2026 Milestones MCP Authorization v24.0 v26.4 v26.6 v26.8 v26.7 supported OAuth 2.1 Authorization Server Metadata Client ID Metadata Document supported experimental preview experimental Resource Indicator MCP Enterprise-managed Authorization ID-JAG as AS experimental preview experimental ID-JAG as IdP 27 Identities and Authentication for your Agents with Keycloak ©Hitachi, Ltd. 2026. All rights reserved
29. Slides: Contacts Takashi Norimatsu Alexander Schwartz Keycloak Maintainer Hitachi, Ltd. Keycloak Maintainer IBM https://www.ahus1.de/