# Keycloak and Istio

DevFeed: [Keycloak and Istio](<https://devfeed.tech/articles/keycloak-and-istio-31568.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2018/02/keycloak-and-istio>)

Author: Sébastien Blanc

Published: 2018-02-26T00:00:00Z

Content type: tutorial

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [istio](<https://devfeed.tech/topics/istio.md>), [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [proxy](<https://devfeed.tech/topics/proxy.md>)

Tags: [envoy-proxy](<https://devfeed.tech/tags/envoy-proxy.md>), [http](<https://devfeed.tech/tags/http.md>), [idm](<https://devfeed.tech/tags/idm.md>), [istio](<https://devfeed.tech/tags/istio.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [load-balancing](<https://devfeed.tech/tags/load-balancing.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [saml](<https://devfeed.tech/tags/saml.md>), [service-mesh](<https://devfeed.tech/tags/service-mesh.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

This short blog post describes early trials of combining Keycloak with Istio. It explains how Istio's Envoy sidecar and JWT authentication filter can take over some security tasks traditionally handled by Keycloak adapters, while noting that the replacement is not yet complete.

## Source excerpt

This short blog post is to share the first trials of combining Keycloak with Istio. What is Istio? Istio is an platform that provides a common way to manage your service mesh. You may wonder what a service mesh is, well, it's an infrastructure layer dedicated to connect, secure and make reliable your different services. Istio, in the end, will be replacing all of our circuit-breakers, intelligent load balancing or metrics librairies, but also the way how two services will communicate in a secure way. And this is of course the interesting part for Keycloak. As you know Keycloak uses adapters for each of the application or service that it secures. These adapters make sure to perform the redirect if needed, to retrieve the public keys, to verify the JWT signature etc ... There are a lot of different adapters depending on the type of application or technology that is used : there are Java EE adapters, JavaScript adapters and we even have a NodeJS adapter. The end of the adapters? Following the Istio philosophy, these adapters would not be needed in the end because the Istio infrastructure will take care of the tasks the adapters were doing (signature verification etc ...). We are not yet there for now but in this post we will see what can already be done with Istio and how much it already can replace the role of the Adapters. The Envoy Sidecar We won't dive into the details on how Istio works but there is one main concept to understand around which Istio is articulated : the Envoy Sidecar. Envoy is a high performance proxy deployed alongside with each deployed service and this is the reason we call it a "sidecar". Envoy captures all incoming and outgoing traffic of its "companion" service, it can then apply some basic operations and also collect data and send it to a central point of decision, called the "mixer" in Istio. The conifugration of Envoy itself happens through the "pilot" an other Istio component. Envoy Filters To make it easier to add new functionnality to t