Red Hat Single Sign-On

Why Red Hat Single Sign-On?

Identity management is fragmented. Each application separate credentials. User password fatigue. Inconsistent MFA. Federation difficult to implement.

Red Hat Single Sign-On is an enterprise identity platform based on Keycloak. SSO - one login everywhere. Federation - LDAP, AD, social. Standards - SAML, OIDC, OAuth. MFA - configurable policies.

How does it work?

Identity Brokering

Centralized authentication:

• LDAP/AD integration
• External IdP federation
• Social login
• User federation
• Token exchange

Protocol Support

Industry standards:

• SAML 2.0
• OpenID Connect
• OAuth 2.0
• Kerberos
• RADIUS

Authorization

Fine-grained access control:

• Role-based access
• Resource-based
• Policy engine
• Claims mapping
• Consent management

Key Features

Authentication

• Username/password
• MFA (TOTP, WebAuthn)
• Passwordless
• Social login
• Kerberos

User Management

• User registration
• Self-service
• Account linking
• Password policies
• Brute force protection

Administration

• Realm management
• Client configuration
• Role mapping
• Group management
• Audit logging

Protocol Support

Protocol	Use Case
SAML 2.0	Enterprise SSO
OIDC	Modern applications
OAuth 2.0	API authorization
Kerberos	Windows integration

Use Cases

Application SSO:

• Web applications
• Mobile applications
• APIs
• Microservices

Identity Federation:

• Partner integration
• Mergers/acquisitions
• Multi-tenant SaaS
• Customer identity

API Security:

• OAuth 2.0 tokens
• API gateway integration
• Token validation
• Scope management

Specification

Foundation	Keycloak
Protocols	SAML, OIDC, OAuth
MFA	TOTP, WebAuthn, SMS
Deployment	On-prem, OpenShift

Who is it for?

• Enterprises implementing SSO
• Organizations with multiple applications
• API-first companies
• Multi-tenant SaaS providers

Benefits

For Users: One login, fewer passwords, better experience

For Security: MFA, centralized policies, audit trails

For IT: Fewer password resets, standards-based, flexible

FAQ

What is Keycloak? Open source project. RH-SSO is the supported version.

Can I federate with Azure AD? Yes. SAML or OIDC federation.

How does MFA work? TOTP apps, WebAuthn (FIDO2), SMS, email OTP.

Does it support social login? Yes. Google, Facebook, GitHub and more.

How does it integrate with OpenShift? Operator available. Native integration.

Can I customize login pages? Yes. Theme customization supported.

What does HA look like? Clustered deployment. Active-active.

Does it support passwordless? Yes. WebAuthn/FIDO2 support.

What is the migration path? RHBK (Red Hat Build of Keycloak) is the successor.

What does support look like? Red Hat support. nFlo offers SSO deployment and integration.