Stian Thorgersen
- Co-founded the Keycloak project at Red Hat in 2013 and leads it
- Co-author of Keycloak: Identity and Access Management for Modern Applications
Bio
Stian Thorgersen co-founded Keycloak at Red Hat in 2013 and is its project lead and top contributor. He is a senior principal software engineer at Red Hat and co-wrote the book most teams learn Keycloak from.
Profile built from public project, employer, and publication records.
Where their work shows up
Keycloak is the reason a team can run standards-complete OpenID Connect, OAuth 2.0, and SAML 2.0 without a vendor contract, which matters most where data residency, air-gapped deployment, or budget rules out SaaS. It anchors the open-source end of the market; see the open-source identity vendors and the best IAM platforms ranking for where self-hosting sits against managed options.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVECisco SAML 2.0 mixes authorization domains
Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The pr
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still