Keycloak: Realm Configuration Tells You Everything

#The Keycloak endpoints that show more than you think

Open up your Keycloak deployment's URL. Add /realms/master/.well-known/openid-configuration at the end. Hit it from your phone on cellular data. No auth. You just pulled the complete authentication architecture of your Keycloak deployment from a network the deployment has never seen before.

This is by design. The OIDC specification requires the discovery endpoint to be public. What the spec doesn't say is that most teams configure Keycloak with verbose realm details, admin URLs exposed, and realm names that disclose internal naming conventions.

Every Keycloak audit we run starts with enumerating what the public endpoints reveal. The amount of information is substantial.

#What the OIDC discovery endpoint reveals

• All supported grant types. tells attackers which auth flows are available
• Token endpoint. where to exchange credentials for tokens
• JWKS URI. The public keys used to sign tokens
• Supported scopes. what data the tokens can access
• Registration endpoint. whether self-registration is enabled

#The admin console

Keycloak's admin console at /admin/ is a full React application. Even without valid credentials, loading the page reveals the Keycloak version (in the HTML), the available realms (via the realm selector). And the authentication flows configured for the admin console itself.

#User self-registration

If self-registration is enabled on a realm, anyone can create an account at /realms/{realm}/account/. Combined with the OIDC configuration, an attacker can create a valid account and then use it to probe the application's authorization model.

#How we detect this

Our scanner:

1. Probes common realm names (master, app, production, etc.)
2. Fetches the OIDC configuration for each discovered realm
3. Checks if the admin console is accessible
4. Tests self-registration on each realm

#Defense

• Restrict admin console access by IP or VPN
• Disable self-registration unless explicitly needed
• Never use "master" as your production realm name. Set a non-default name per environment.
• Put Keycloak behind a reverse proxy that blocks /admin/ from external access