Keycloak

Securing AI Agents with Database Access Using Token Exchange, DPoP and Row-Level Security

The article explains how to safely grant AI agents access to production databases without exposing excessive privileges. It draws on decades-old security principles such as least privilege and the confused deputy problem, now applied to LLM agents that can be tricked by prompt injection. The recommended architecture replaces persistent service-account tokens with short-lived, attenuated tokens obtained via OAuth 2.0 Token Exchange (RFC 8693) and bound to the client using DPoP (RFC 9449). Human confirmation for sensitive actions is handled through OpenID CIBA, delivering approval directly inside the chat interface. PostgreSQL Row-Level Security enforces the final authorization boundary by checking the user subject on every query. A ready-to-run demo built with issuerd and Keycloak demonstrates the full flow, including prompt-injection attempts and stolen-token attacks that are automatically rejected.

RWB Deploys Enterprise-Wide Database Access Control with Trino and Open Policy Agent

RWB has replaced fragmented manual database access processes with a centralized architecture built on Trino as the single entry point and Open Policy Agent for policy enforcement. The system enforces least-privilege access, mandatory auditing, and automated revocation tied to HR records while eliminating anonymous and password-based logins. Access requests now complete in 3–10 minutes instead of an average of four days, with 92 percent handled automatically. Key components include Keycloak for OIDC authentication, Vault for secrets, Kafka for security event streaming to SOC, and Kubernetes orchestration. Responsibility is split across AI & Data Security, Core DevOps, Access Management, SOC, and Trust & Safety teams. More than 1,250 PostgreSQL clusters and 90 projects are now connected, with real-time dashboards tracking adoption and policy health.

Keycloak Cluster on Three VMs: Engineers Detail Embedded Infinispan Setup, HA Testing Failures, and Bug Fix

A team deployed Keycloak for 25,000–30,000 users across a country using three isolated VMs instead of Kubernetes. They chose Embedded Infinispan with JGroups over an external cluster to reduce failure points and maintain session replication. PostgreSQL with Patroni handled shared storage and JDBC_PING discovery. Testing revealed that full datacenter outages triggered split-brain conditions and 5xx errors that the built-in healthcheck could not resolve. The engineers wrote a Python watcher script to detect multiple coordinators in the JGROUPS_PING table and restart affected containers. They reported the recovery bug to the Keycloak project, which was confirmed and fixed in a later release. The production cluster now survives single-DC loss without session loss.

Alfa-Bank Balances Cloud Trust and Zero Trust Models During Migration to Yandex Cloud

Alfa-Bank's head of container and cloud security, Sasha Chertok, detailed how the bank migrated regulated workloads to Yandex Cloud while preserving existing Zero Trust controls. The organization mapped on-premises network segmentation, Active Directory authentication, and firewall policies directly onto Yandex Cloud resources using interconnect links secured with GOST encryption. Responsibility for managed services is shared under a Cloud Trust model, yet the bank retains oversight through Terraform-managed Security Groups, custom CSPM checks, and internal CI/CD gates. User access continues to authenticate via on-premises Active Directory and KeyCloak federations, while authorization leverages granular Yandex Cloud IAM roles. Logging and detection rely on a combination of Yandex Cloud Audit Trail, Cloud Logging, and the YCDR service to compensate for incomplete control-plane visibility. The resulting hybrid architecture now supports 1,500 virtual machines, 100 managed services, and 1,000 identities across multiple environments without disrupting established security processes.

redb.Identity Deploys Three-Layer Defense to Neutralize Stolen Access Tokens in OpenID Connect

redb.Identity, a custom OAuth 2.1 and OpenID Connect provider built on .NET, addresses the inherent risks of bearer access tokens by implementing three distinct protection layers. The first layer uses a Backend-for-Frontend pattern with Blazor Server and HttpOnly cookies to ensure no tokens ever reach the browser. The second layer applies DPoP proof-of-possession binding so that a stolen token remains useless without the corresponding private key. The third layer provides rapid revocation through RFC 7009 endpoints, refresh token rotation, idle timeouts, and a hybrid push-pull backchannel logout mechanism that guarantees no revocation is lost across replicas. The architecture also mitigates XSS vectors from direct application code, compromised npm dependencies, browser extensions, and localStorage. Additional routine controls include constant-time secret comparison, TOTP replay protection, rate limiting at multiple scopes, and sanitized proxy headers. The design explicitly acknowledges that BFF shifts rather than eliminates risk, requiring complementary CSRF protection via SameSite cookies and antiforgery tokens.

Keycloak Fixes Critical CVE-2026-18963 Password Reset Flaw Allowing Unauthenticated Account Takeover

Keycloak has patched a critical vulnerability tracked as CVE-2026-18963 that lets remote unauthenticated attackers force a password reset for any user and seize control of the account. The flaw affects the reset-credentials flow due to improper state validation, enabling attackers to bypass email verification and reach the password change endpoint directly. With a CVSS 3.1 score of 9.1, the issue requires no privileges or user interaction and impacts confidentiality and integrity. Patches are available in Keycloak 26.7.2 and corresponding Red Hat Build of Keycloak releases 26.4.15 and 26.6.6. Organizations unable to update immediately should disable the Forgot password feature across all realms. Post-remediation auditing of login events and credential changes on privileged accounts is recommended to detect any prior exploitation attempts.

Building a Minimal Open Source Security Stack for Infrastructure Protection

The article outlines a practical approach to assembling a basic cybersecurity stack using open source tools for organizations with limited budgets. It covers endpoint protection with ClamAV, network perimeter defense via pfSense including Snort and Suricata integration, centralized logging with ELK Stack or Wazuh, and identity management through Keycloak. The guide emphasizes that these solutions provide foundational capabilities but require careful configuration, regular updates, and community validation to avoid risks from unmaintained projects. Detailed installation steps, rule configuration examples, and integration advice are provided for each component. The author stresses that open source options serve as an entry point rather than a full replacement for commercial platforms like Kaspersky or Symantec.

Step-Up Authentication vs 2FA: Implementing Additional Verification for Sensitive Operations in Corporate Systems

Traditional two-factor authentication secures only the initial login, leaving active sessions vulnerable to misuse during sensitive tasks such as accessing payroll data. Step-Up Authentication addresses this by requiring extra verification at the moment of critical actions rather than at login. The article details how one project moved beyond standard Identity Provider features in WSO2 by building a dedicated PIN-code service and gateway-2fa microservice. This approach uses signed cookies with TTL controls and JWT cross-checks to enforce elevated trust levels without disrupting normal user flows. The solution aligns with Zero Trust principles and was monitored via Matomo and ELK for usage and performance metrics. Key implementation considerations include balancing TTL duration, encrypting stored PINs, and conducting load testing before deployment.