Keycloak and the Essential Eight: MFA, admin access and logging
- Keycloak can enforce phishing-resistant MFA using WebAuthn security keys and passkeys.
- Its login and admin events can feed your SIEM for central logging.
- Keycloak helps with several strategies, but no single product makes you Essential Eight compliant.
Where Keycloak fits
The Essential Eight is the Australian Signals Directorate's baseline of mitigation strategies. As your organisation's identity provider, Keycloak is directly relevant to three of them:
| Strategy | How Keycloak helps |
|---|---|
| Multi-factor authentication | OTP, WebAuthn security keys and passkeys, enforced through authentication flows |
| Restrict administrative privileges | Separate admin realm, fine-grained admin roles, MFA on admin accounts |
| Patch applications | Keycloak itself must be kept current; plan regular upgrades |
Phishing-resistant MFA
ASD expects phishing-resistant MFA from Maturity Level Two. One-time codes from an app or SMS can be phished; WebAuthn can't, because the credential is bound to your site's origin.
- Register WebAuthn (security keys or platform authenticators) as a required action
- Use passkeys for passwordless, phishing-resistant sign-in
- Use conditional flows to require stronger factors for admins and sensitive apps
- Phase out SMS and plain OTP as users enrol stronger factors
Central logging
At higher maturity levels, successful and unsuccessful MFA events need to be centrally logged. In Keycloak:
- Enable login events and admin events per realm
- Forward them to your SIEM with an event listener or log shipping
- Alert on repeated failures, new admin role grants and MFA resets
Locking down administration
- Keep the
masterrealm for platform admins only - Grant realm-specific admin roles instead of global ones
- Require phishing-resistant MFA for every admin account
- Restrict the admin console to internal networks where possible
Essential Eight FAQ
Does Keycloak make us Essential Eight compliant?
No single product does. Keycloak supports the identity-related controls, but maturity is assessed across all eight strategies.
Are passkeys phishing-resistant?
Yes. Passkeys use WebAuthn, which binds credentials to the site's origin so they can't be replayed on a fake site.
This guide is general information, not a compliance assessment. Always check the current Essential Eight Maturity Model on cyber.gov.au.
Working towards Maturity Level Two? Talk to us about phishing-resistant MFA and audit-ready logging in Keycloak.