keycloak-iamlisted

# Keycloak IAM — operator's reference skill This skill covers running, configuring, deploying, and integrating with **Keycloak**, the open-source identity & access management server. It targets the modern **Quarkus-based** distribution (24.x → 26.7.x as of July 2026); for instances still in the field on 16.x–23.x — including the WildFly **"-legacy"** builds that ended at 19.0.3 — and for verifying realm migrations off them, route to `legacy-and-migration.md`. Information is current as of **Keycloak 26.7.0** (released 2026-07-09); the body below is still written against the 26.6 feature set, so treat 26.7-only features as unresearched here and read the release notes directly. The Red Hat build of Keycloak (RHBK) is downstream of upstream Keycloak with longer support windows and the same surface area; advice here applies to both unless explicitly noted. **Siblings in the `k8s` plugin.** Keycloak is almost always deployed behind something and packaged by something, and both are common failure sources rather than Keycloak bugs: reverse-proxy headers, TLS termination and rate limiting in front of it are **`traefik-hardening`** (a Keycloak that emits wrong issuer URLs or loops on redirect is usually a proxy-header problem, not an IAM one); authoring or fixing the chart that deploys it is **`helm`**; running it under OpenShift's SCC and arbitrary-UID constraints is **`openshift-app`**. ## How to use this skill Keycloak is a large product. Don't try to load everything — route to