Overview

A portfolio-grade enterprise IAM platform demo that shows how modern authentication, federation, and provisioning actually work in real life.

The Problem

Most IAM portfolio projects prove configuration skill, not protocol understanding. A typical project shows Keycloak or another vendor product configured for login, but it does not show why the protocol behaves that way or what security decisions matter underneath.

This project fixes that gap by building the protocol surface directly and making the decisions visible.

Why This Is Worth Building

It creates a much stronger signal than a CRUD app with SSO attached
It directly supports IAM architect and senior engineer interviews
It turns protocol knowledge into something demonstrable, not just theoretical
It connects closely to real enterprise work in banking, SaaS, and IGA environments

Why Not Just Use Keycloak

"Keycloak already does all of this. Why build it?"

This is the right question — and the answer is the entire point of the project.

Dimension	Using Keycloak	Building This Project
What you learn	Admin UI, realm config, client settings	`/authorize` logic, PKCE validation, token signing, SAML assertion handling
What you can explain	"I configured a client in Keycloak"	"I built the endpoint, here is why PKCE prevents auth code interception"
Protocol depth	Hidden behind the product	Fully visible and deliberately built
Interview signal	Configuration skill	Protocol and security decision-making
Debugging skill	Reading Keycloak logs	Understanding what went wrong at the RFC level
Differentiator	Every IAM candidate has done this	Very few candidates have done this

Keycloak is a production-grade platform used in real enterprise environments. That is exactly why configuring it is table stakes — not a differentiator.

The point is not to replace Keycloak. The point is to understand what Keycloak is actually doing underneath. This project builds the protocol surface so the behaviour is no longer a black box.

Keycloak is also used in this project — as a backup local IdP for SAML testing when Entra ID is unavailable. That is the right use of it: a reference implementation and test peer, not a crutch that hides the work.