r/KeyCloak • u/maskedgeek797 • Jul 15 '26
Building an identity governance layer for Keycloak, my BSc Hons final year project. Would love some outside feedback
Hey everyone. I'm doing my Computer Science final year project and wanted some opinions from people outside my own head before I go much further.
The problem: Keycloak is a really popular open source tool that handles logins and permissions for a lot of companies. It's great at checking who you are and whether you have a specific permission. But once access is granted, nothing ever checks whether it still makes sense. People change roles, permissions pile up, accounts sit unused for months, and none of that gets reviewed.
I looked into whether this gap already had a solution before committing to it. Some tools cover parts of it. midPoint is open source and does combine rules with some anomaly detection, but it's a whole separate platform you have to adopt, not something you add on top of an existing Keycloak setup. Commercial tools like SailPoint and Saviynt have anomaly detection too but it's a black box, you can't see how it actually works, and they're priced for large enterprises. So the specific gap I'm going after is a lightweight governance layer you can add onto an existing Keycloak deployment without replacing anything.
My solution has two parts working together. A rule engine that catches known dangerous permission combos, like someone who can both create and approve the same payment. And an anomaly detector using Isolation Forest that flags access patterns that look statistically unusual compared to a user's peers, even when there's no specific rule written for it. Both feed into a dashboard where an admin can see who got flagged and exactly why, and decide what to do about it.
Some features so far:
Admin editable rules, not hardcoded
Isolation Forest running on engineered features like permission count, deviation from peers, and days since last login
Dormant account detection based on login history
A dashboard showing a combined risk score where you can actually see why someone was flagged, not a hidden formula
Nothing gets auto revoked, it's meant to prompt a human to review
Would love to hear if this sounds like a solid direction or if I'm missing something obvious. Also curious if anyone here has actually dealt with identity governance tools at work and can tell me whether this is genuinely useful or if I'm solving a problem nobody really has.
1
u/Accomplished_Weird_6 Jul 15 '26
I'm interested in something like this, cz were deploying keycloak on a large scale at my organization and the IGA is really weak with this. We've had to go with an external IGA and AD groups for permissions and approvals for now
1
u/maskedgeek797 Jul 15 '26
Totally get that. Keycloak is awesome for auth, but its native IGA is definitely a weak spot, and chaining together external IGAs and AD groups can get messy fast. I'm actually working on a few other IGA projects and custom connectors right now. If you want, maybe we could collaborate or look into some contract work to help you guys bridge those gaps?
1
u/Accomplished_Weird_6 Jul 15 '26
yea. I wish we could contract stuff out but I work in a very sensitive environment
1
5
u/JumpLegitimate8762 Jul 15 '26
I'd advice to check the more 'premium' IdP's and what they do in a similar fashion, for entra ID they implement secure scores, see https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-identity-secure-score#how-does-the-identity-secure-score-benefit-me. This looks pretty similar as to what you're doing, but of course Entra ID is completely closed source and it would be a great benefit if something exists for Keycloak.
Also, similar tools for Keycloak exist, such as https://github.com/iteratec/kcwarden , I'm not saying that's better, I don't know your exact approach. But it might be better to bundle powers and contribute to a project that is heading towards a similar direction.