Catalog / Security & identity

Keycloak

Identity and access management with OIDC, OAuth 2.0, SAML and single sign-on

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace26.8.1↗ Azure Marketplace26.8.0↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
26.8.1$0.05/hr
Recommended instance: m6i.large · 5-day free trial
2026-10-23Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
26.8.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-05Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamKeycloak
Machine-readableproduct.json · catalog.json
What is Keycloak

Keycloak is an open-source identity and access management (IAM) server built on Java and Quarkus. It gives applications single sign-on and standards-based authentication and authorization through OpenID Connect, OAuth 2.0, and SAML 2.0, plus realm-based multi-tenancy, role-based access control, user federation against LDAP and Active Directory, identity brokering, social login, fine-grained authorization, and a full admin and account console. Applications integrate through the per-realm OIDC discovery document and standard token endpoints, so any compliant OIDC or SAML client works without vendor SDKs. Keycloak requires a production relational database; this image bundles a local PostgreSQL instance and rotates its password at first launch. Apache-2.0 license, no vendor lock-in - the same codebase as the Red Hat build of Keycloak, with no open-core feature gating.

What the Lynxroute image adds

Security hardening:

  • Production mode (kc.sh build, then start --optimized) against a bundled local PostgreSQL - the embedded H2 database, which upstream supports for development only, is not used
  • Random admin password generated at first launch and written to /root/keycloak-credentials.txt (root-only); no password is baked into the image
  • PostgreSQL password also generated per instance at first launch
  • nginx TLS perimeter on port 443 (self-signed certificate; Certbot pre-installed so a CA-signed certificate is one command away)
  • Keycloak HTTP (8080), management and health (9000), and PostgreSQL (5432) all bound to 127.0.0.1 only
  • UFW firewall pre-configured (ports 22, 80 and 443 only; 80 redirects to HTTPS)
  • fail2ban, auditd, AppArmor pre-configured
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/keycloak-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-cvh5rpn22va6w/latest \
  --instance-type m6i.large --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer keycloak --plan payg-gen2
az vm create -g my-rg -n keycloak --size Standard_D2s_v3 \
  --image lynxroute:keycloak:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Keycloak 26.8.1

AWS · 2026-10-23
  • Keycloak updated 26.8.0 -> 26.8.1, a security release. Apache-2.0 unchanged
  • Security: about 20 CVEs fixed, including fine-grained admin permission escalation (CVE-2026-94000, CVE-2026-94001, CVE-2026-97177), a two-factor authentication bypass (CVE-2026-94218), cross-realm access (CVE-2026-94215), an SMTP StartTLS downgrade (CVE-2026-107121) and a CRL path traversal (CVE-2026-103884)
  • Behaviour changes: SMTP StartTLS is enforced when enabled, backchannel logout signatures are always verified, X.509 CRL paths must live under conf/, and identity-provider secrets must be re-entered when the destination changes
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build