Authentication · Social Login
Let users sign in with the accounts they already have
We configure Keycloak identity brokering for Google, Microsoft, GitHub and other providers — with account linking, clean profile data and a first-login experience that doesn't leave you with duplicate users.
- Built-in social identity providers
- Account linking & first broker login
- Runs on upstream Keycloak 26.x
Standards & integrations
- OpenID Connect
- OAuth 2.0
- Microsoft
- GitHub
Overview
The button is easy. The identity behind it isn't.
Adding a Google button takes minutes. Deciding what happens when that Google account shares an email with an existing user, which profile fields you trust, and how someone who signed up with a password links a social account later — that's where duplicate accounts and takeover risks come from. We design the first-login flow, mappers and linking rules so every sign-in lands on the right user.
What we deliver
- Provider selection and trust-rules document
- Identity providers configured as code (Terraform / OpenTofu)
- First broker login flow tailored to your linking rules
- Attribute, role and group mappers per provider
- Login page with provider ordering and visibility
- Runbook for rotating provider secrets and adding providers
Capabilities
What Social Login covers
Configured, tested and documented on upstream Keycloak — then handed over or operated by us.
Built-in providers
Google, Microsoft, GitHub, GitLab, Facebook, LinkedIn and others come from Keycloak's built-in providers; Sign in with Apple is added through an extension, and other OIDC providers through the generic connector.
A first-login flow you control
The first broker login flow decides whether to review the profile, create a new user or link to an existing one — configured to your rules instead of left on defaults.
Safe account linking
Existing users prove ownership by email or by re-authenticating before a social account is linked, so nobody gains access through an unverified address.
Attribute and role mappers
Identity provider mappers import names, emails and custom claims into the user profile and assign roles or groups based on how someone signed in.
Registration and profile completion
Self-registration, the declarative user profile and the review-profile step collect the fields your app needs, whether a user starts with a password or a social account.
A login page that fits
Choose which providers appear and in what order, hide some from the login page, and send users straight to one provider with kc_idp_hint.
How it works
From first call to production
Choose providers and trust rules
We agree which providers you offer, which of their claims you trust, and how social identities relate to accounts that already exist.
Configure and harden
Providers, mappers and the first broker login flow are defined as code, with redirect URIs, client secrets and scopes locked down per environment.
Test the edge cases
Duplicate emails, unverified addresses, linked and unlinked accounts and revoked provider access are all tested before the buttons go live.
Use cases
Where teams put it to work
Consumer sign-up
New users start with Google or Apple instead of inventing another password, then complete only the profile fields you require.
Developer platforms
Offer GitHub or GitLab sign-in to a technical audience, alongside email and password for everyone else, on the same user record.
Adding social to an existing user base
Existing password users link Google or Microsoft from the Account Console without ending up with a second account.
FAQ
Social Login questions, answered
What happens if a social login email matches an existing account?
Keycloak's first broker login flow asks the user to confirm the link and prove they own the existing account, by email or by signing in. We tune that behaviour so accounts are never merged on an unverified email.
Is Sign in with Apple supported?
Not as a built-in provider in upstream Keycloak. We add it through a maintained open-source extension or a custom identity provider SPI, and keep it compatible across upgrades.
Can users link or unlink social accounts themselves?
Yes. The Account Console lets users manage linked identity providers, and whether they can is controlled through the account client's roles.
Does Keycloak keep its own copy of the user?
Yes. A local user is created or linked on first login, and the provider's sync mode controls whether profile data is imported once or refreshed from the provider on every login.
Ready to roll out Social Login?
Walk us through your requirements on a free strategy call. We'll come back with an architecture, a delivery plan and a fixed scope.