---
title: "Keycloak (Identity Broker)"
slug: "keycloak-identity-broker"
description: "This page describes how Autoform DM SSO uses the Keycloak identity broker software."
tags: ["Single sign-on (SSO)", "Keycloak", "Autoform DM"]
updated: 2024-11-15T10:00:48Z
published: 2024-11-15T10:00:48Z
canonical: "kb.lasernetgroup.com/keycloak-identity-broker"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.lasernetgroup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Keycloak (Identity Broker)

The Autoform DM SSO capability requires that Keycloak is installed and available to act as an identity broker for Autoform DM.

The (typical) supported Keycloak deployment scenarios are described below.

Decide the preferred architecture in advance of setting up Autoform DM SSO, so that naming and connectivity matters can be considered during the setup process.

> [!NOTE]
> Note
> 
> Autoform DM can use an existing Keycloak instance that is already used by other applications. In this scenario, Autoform DM will be introduced into the existing security domain.

## Dedicated Keycloak Instances

Each Autoform DM environment uses its own dedicated Keycloak instance and no other applications are integrated into each instance.

This could be the preferred option if a strong demarcation between applications and systems is required or if there are network constraints. However, using more Keycloak instances creates additional configuration and maintenance overhead.

## Shared Keycloak Instance

To reduce resource and maintenance overheads, a single Keycloak instance can be shared by multiple Autoform DM installations. For example, two Autoform DM environments (Dev and Test) can share a Keycloak instance.