Bill Burke
- Co-created Keycloak at Red Hat in 2014 with Stian Thorgersen
- Founded the RESTEasy project, a JAX-RS implementation
- Former chief architect of JBoss
Bio
Bill Burke co-created Keycloak at Red Hat with Stian Thorgersen, founded the RESTEasy project, and was previously chief architect of JBoss. He is a Red Hat fellow.
Profile built from public project and employer records.
Where their work shows up
The JBoss lineage shows in Keycloak's central premise: authentication belongs outside the application, spoken over a standard protocol, with adapters doing the integration rather than each service rolling its own login. That is unremarkable now and was not when most Java applications shipped their own user table. See the Keycloak profile, OAuth vs OIDC, and the developer recipes.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b