Legacy App SSO · Other Legacy Apps
SSO for the apps that never learned SAML
Plenty of business-critical applications only understand an HTTP header, a cookie or their own login form. We put a hardened identity-aware proxy in front of them, authenticate users at Keycloak, and hand each application exactly the identity it expects.
- No application code changes
- Header injection hardened
- MFA in front of every app
Standards & integrations
- OpenID Connect
- SAML 2.0
- OAuth2 Proxy
- Apache mod_auth_openidc
- Apache mod_auth_mellon
- NGINX
- Trusted headers
Overview
Meeting old applications where they are
When an application can't speak SAML or OpenID Connect, the usual answer is a proxy that can. The proxy handles the login with Keycloak, holds the session, and forwards requests with a trusted identity header the application already supports. Done carelessly, that header becomes a way in for anyone who can set it. We design the network path, strip client-supplied headers, and test the setup the way an attacker would.
What we deliver
- Application inventory with sign-on model per app
- Identity-aware proxy deployed as code
- Header hardening and network restrictions
- Keycloak clients, roles and groups per application
- Header-injection and direct-access test results
- Runbook for onboarding further applications
Capabilities
What Other Legacy Apps covers
Configured, tested and documented on upstream Keycloak — then handed over or operated by us.
Identity-aware proxy
OAuth2 Proxy, Apache mod_auth_openidc or mod_auth_mellon, or NGINX with an auth sub-request — chosen for your platform and managed as code.
Header hardening
Client-supplied identity headers are stripped, the app only accepts traffic from the proxy, and nothing else on the network can reach it directly.
Per-app authorization
Keycloak roles and groups decide who reaches each application before a request is ever forwarded.
MFA without app changes
Every proxied app inherits Keycloak's MFA and passkey policies on day one.
Logout and session control
Proxy sessions end with Keycloak sign-out and follow the same idle and maximum lifetimes as your other applications.
A path to modern protocols
When an app gains SAML or OIDC support, it moves off the proxy onto a direct Keycloak client without users noticing.
Compatibility
Common legacy applications
Typical patterns we use. Each app's documented SSO mode is confirmed for your version before design.
| Platform | Integration | Notes |
|---|---|---|
| Oracle Hyperion EPM | Trusted header from the proxy | Uses EPM's header-based SSO option; confirm for your release. |
| OBIEE / Oracle Analytics Server | Trusted header or access-manager style SSO | Confirm the SSO modes your version supports. |
| Oracle Forms and WebLogic apps | Header via proxy with a WebLogic identity asserter | Requires a suitable identity assertion provider in WebLogic. |
| Custom Java / .NET apps | Header via proxy, or direct OIDC | Direct OIDC is preferred when code changes are possible. |
| Apps with basic auth only | Case by case | Often MFA at the proxy while the app keeps its own login. |
How it works
From first call to production
Inventory apps and login models
We record how each application authenticates today — header, cookie, basic auth or form — and what identity attribute it expects.
Deploy and harden the proxy
The proxy is deployed as code in front of the first apps, with network restrictions and header stripping tested before real users arrive.
Migrate apps in batches
Applications move behind the proxy in small groups, each with its own test plan and rollback.
Use cases
Where teams put it to work
Oracle EPM and analytics
Hyperion and OBIEE-era tools that support header-based SSO get Keycloak login and MFA.
In-house applications
Custom Java or .NET apps that read a user header join SSO without a rewrite.
Vendor apps with no SSO roadmap
Bring vendor software that only supports headers or basic auth under central access control.
FAQ
Other Legacy Apps questions, answered
Which applications can work behind a proxy?
Any app that can accept a user identity from an HTTP header, a cookie set by the proxy, or basic authentication. We check each app's documented SSO options before designing anything.
What about apps that only have a login form?
Form-only apps are the hardest case. Options include a header mode the vendor already offers, a small authentication plugin, or MFA at the proxy while the app keeps its own login. We'll tell you which is realistic for each app.
Isn't Keycloak Gatekeeper the standard proxy?
Keycloak Gatekeeper was deprecated some time ago. We use maintained options such as OAuth2 Proxy or the Apache modules instead.
Ready to roll out Other Legacy Apps?
Walk us through your requirements on a free strategy call. We'll come back with an architecture, a delivery plan and a fixed scope.