University Identity and Access Management Infrastructure with Keycloak: Lessons Learned

This paper presents a solution for an identity and access management system at the Technical University of ClujNapoca. The setup makes use of the open-source tool Keycloak for single sign-on, deployed in a high availability setup. An indepth view into the proposed infrastructure is available in the article with a focus on technical overviews. Integration with Microsoft EntraID, is described with a particular use case scenario where a conditional flow was created for filtering users of domains other than that used for the university students. Federated identity integration with eduGAIN is finally attested and validated with the help of a bridge, from Keycloak to it, in the form of an open source solution written in PHP. EduGAIN check services are used to confirm compliance of our system, with eduGain requirements. In an attempt to have a university single sign-on solution that enables collaboration with European research and education entities, this work lays the foundation for such a long haul endeavor.