Skip to Content
🔐 Faable AuthMigration GuidesMigrate from Keycloak

Migrate from Keycloak to Faable Auth

Short answer: Migrating from self-hosted Keycloak to Faable Auth removes the servers, upgrades, and database you currently operate, while keeping the same OAuth 2.0 / OpenID Connect standards. You map each Keycloak realm to a Faable Account, your Keycloak clients to Faable Clients, and your identity providers to Faable Connections, then export your users and import them into Faable. The motivation is almost always the same: stop operating identity infrastructure while staying 100% in Europe under GDPR — Faable Auth is fully managed, so there is nothing to patch, scale, or back up.

Concept mapping

KeycloakFaable AuthNotes
RealmAccountYour isolated identity boundary
ClientClientSPA, native, regular web, or M2M
Identity Provider (social/OIDC)ConnectionOAuth 2.0 / OIDC only — no SAML yet
User federation (LDAP/AD)Connection over OIDCNo direct LDAP bind — federate via OAuth/OIDC
Authentication SPI (Java)ActionsCustom in-flow logic, no Java/SPI to maintain
Admin REST APIManagement APICalled with client credentials
Self-hosted servers + DBFully managedNo infrastructure for you to run

Migration steps

  1. Create your Account in the Faable Dashboard  and note your issuer URL.
  2. Map realms to accounts. Each Keycloak realm becomes a Faable Account; if you ran one realm per customer, model those as teams/accounts.
  3. Recreate Connections. Translate each Keycloak Identity Provider into a Faable Connection (social or generic OIDC), reusing upstream client credentials.
  4. Recreate Clients with the same redirect URIs, web origins, and flow types.
  5. Replace SPIs with Actions. Move custom authenticator SPIs to Actions — JavaScript in the flow instead of compiled Java extensions.
  6. Export and import users. Export the realm with kc.sh export --users realm_file and import it with faable auth users import realm.json --from keycloak. Users keep their passwords: PBKDF2-SHA256/SHA512 and the Argon2 default of Keycloak 24+ import as they are and are upgraded to Argon2id on first sign-in. Identity-provider links become identities, so social users keep their account. Plain pbkdf2 (SHA-1) is refused as weak; those users need Forgot password. See Import and export password hashes.
  7. Decommission your Keycloak deployment once traffic is on Faable — and reclaim the operational time you spent running it.

What you stop maintaining

  • Server provisioning, JVM tuning, and clustering
  • Database backups, migrations, and version upgrades
  • Security patching of the Keycloak runtime
  • High-availability and scaling for login spikes

Last updated on

Migrate from Clerk🔧 CLI