# Keycloak Federated Client Authentication with External Identity Providers

DevFeed: [Keycloak Federated Client Authentication with External Identity Providers](<https://devfeed.tech/articles/federated-client-authentication-no-more-secrets-31743.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/01/federated-client-authentication>)

Author: Stian Thorgersen

Published: 2026-01-26T00:00:00Z

Content type: tutorial

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [openid](<https://devfeed.tech/topics/openid.md>), [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [trust](<https://devfeed.tech/topics/trust.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [idm](<https://devfeed.tech/tags/idm.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [lookup](<https://devfeed.tech/tags/lookup.md>), [openid](<https://devfeed.tech/tags/openid.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [saml](<https://devfeed.tech/tags/saml.md>), [signing](<https://devfeed.tech/tags/signing.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [sso](<https://devfeed.tech/tags/sso.md>), [token](<https://devfeed.tech/tags/token.md>), [verify](<https://devfeed.tech/tags/verify.md>)

## AI overview

Keycloak's federated client authentication lets OpenID Connect clients authenticate through external identity providers such as OpenID Connect, SPIFFE, and Kubernetes. The article explains trust relationships, JWT claims, token verification, and how this can reduce the need for client-managed secrets in some environments.

## Source excerpt

Keycloak has from day one supported identity brokering, allowing users to authenticate via an external OpenID Connect or SAML 2.0 identity provider. With federated client authentication it is now possible to authenticate OpenID Connect clients through external identity providers as well. Depending on the environment the clients is running in this can eliminate the need for managing secrets for clients altogether. A number of cloud vendors for example support injecting tokens automatically for workloads, Kubernetes have support for service accounts, and last but not least there is SPIFFE that can be leveraged in most environments. How does federated client authentication work? The first step to setting up federated client authentication is to define a trust relationship between Keycloak and the external identity providers. This is done by creating a new identity provider in the realm. Keycloak currently has three types of identity providers that support federated client authentication: OpenID Connect SPIFFE Kubernetes Clients can retrieve a token from the external identity providers that the client can then use to authenticate with Keycloak. In many cases clients can retrieve these tokens automatically through workload identity capabilities enabled for particular environments. Let's look at an example decoded JWT that can be used to authenticate a client: { "iss" : "https://my-external-idp" "aud" : [ "http://my-keycloak/realms/myrealm" ], "exp" : 1769149961, "iat" : 1769149661, "sub" : "client-id-in-my-external-idp" } The most relevant claims are iss, aud and sub. Keycloak uses the iss claim to identity the external party that issued the token as well as retrieving the external parties signing keys to verify the token. The aud claim is to make sure the token was issued to be used by Keycloak and not other applications. It is important that this contains a single audience that uniquely identifies Keycloak as the target audience, as leaking this token to other parties