• Change authentication requirements in real-time based on wider context
• Strengthen security - Require MORE factors when user attempt is suspicious or accessing sensitive resources
• Better User Experience - Require LESS factors when risk of fraudulent user is low
• Integration with remote services - For more information about the user or helping evaluating data via remote services
• Gather more information about user in a secure way
• Uses Risk-based authentication
• Uses AI services for more complex risk evaluations

	OpenAI ChatGPT Default model: gpt-4o-mini
	Anthropic Claude Default model: claude-haiku-4-5-20251001
	Google Gemini (free tier available) Default model: gemini-2.5-flash-lite
	IBM Granite (deprecated) Default model: granite-8b-code-instruct-128k

Risk is evaluated locally as much as possible. AI engines are only used for complex evaluations that require deeper contextual analysis. Since AI services are external dependencies, all user data (IP addresses, device info) is automatically anonymized before being sent to prevent information leakage. See Privacy and Anonymization Guide for details.

For more information and setup, see the AI Integration Guide.

Build and try it out locally:

./mvnw -f core clean install -DskipTests -Pbuild-distribution
./mvnw exec:exec@start-server

The generated JAR (core/target/keycloak-adaptive-authn-*.jar) can be added to the /providers folder of your Keycloak distribution. It is also available as a Maven package:

<dependency>
    <groupId>io.github.mabartos</groupId>
    <artifactId>keycloak-adaptive-authn</artifactId>
    <version>${version}</version>
    <type>jar</type>
</dependency>

For full build instructions, installation options, and configuration, see the Start Guide.

1. Unlocking Adaptive Authentication (most recent)
   • Keycloak DevDay @ Darmstadt, Germany 2025
   • Slides
   • Talk
2. Adaptive Authentication
   • KeyConf24 @ Vienna, Austria 2024
   • Slides
   • Talk
   • Demo
3. AI-powered Keycloak
   • OpenShiftAI Roadshow @ Bratislava, Slovakia 2024
   • Slides
4. Adaptive Authentication
   • Master's thesis completed 2024
   • (Information might differ)
   • Document

NOTE: Authentication policies that were part of this Adaptive authentication initiative were moved to repository mabartos/keycloak-authn-policies.