Skip to main content

5 posts tagged with "extensions"

View All Tags

Keycloak slow migration vs fast migration: moving your users

· 11 min read
Jeff Patzer
Phase Two

A slow migration moves users from a legacy system into Keycloak one at a time, as each of them logs in. It goes by other names too: lazy migration, just-in-time (JIT) migration, trickle migration. Nobody gets a password reset email, there is no cutover weekend, and users who never come back are never migrated.

The other side is a fast migration: a bulk import that moves every user into Keycloak at once, before or at cutover. It is quicker to finish and easier to reason about, but it needs something a slow migration doesn't, usually the users' password hashes.

Keycloak doesn't ship slow migration. You add it with a user storage provider, and the one almost everyone uses is open source on GitHub: daniel-frak/keycloak-user-migration. This post covers how slow and fast migrations work, where the code lives, how to choose, and how to combine the two so a slow migration doesn't drag on for months.

Slow migrationFast migration
When users moveOne at a time, at their next loginAll at once, at import
Password hashes neededNo, the legacy system checks passwordsYes, or users set a new password
Legacy system after cutoverMust stay up and answer the migration endpointsCan be turned off
Dormant usersNever migrated unless you add a final stepMigrated with everyone else
Time to finishWeeks to months, plus a long tailHours to days

Replacing Keycloak's Infinispan Caches with Redis/Valkey (Keycloak DevDay 2026)

· 7 min read
Jeff Patzer
Phase Two

At Keycloak DevDay 2026, we shared our work on replacing Keycloak's distributed Infinispan caches with Redis/Valkey.

For the full technical deep dive, we will release slides when the talk is published on Youtube.

This post focuses on the core technical content from the presentation and summarizes what we built, what we learned, and what comes next.

Run the Keycloak Admin UI Locally (with Phase Two Extensions)

· 5 min read
Jeff Patzer
Phase Two

Developing custom additions to the Keycloak Admin UI can be fiddly and slow. At Phase Two we maintain several popular community extensions that must track frequent Keycloak releases. Below is the approach we use to develop and verify Admin UI changes quickly against a running Keycloak image that includes our extensions.

Phase Two Releases Self Service Resource Management

· 2 min read
Jeff Patzer
Phase Two

We’re excited to announce the release of Self-Service Resource Management in the Phase Two Dash. This new capability empowers customers running dedicated Keycloak clusters to directly upload and manage their own resources—such as custom themes and extensions—without waiting for Phase Two intervention.

Presentation on Extending Keycloak for All Your Identity Use Cases

· One min read
GR Patil
Phase Two

We recently gave a talk at the Keyconf24 conference in Vienna on how to extend Keycloak using its extensible SPI structure. In addition to showing what is possible and how to get started in building extensions, we also use our Events and Webhooks extension as a real-world example. The hosts of the conference have posted the video of the talk on Youtube.