Keycloak + Sigstore: Binding Human Identity To Artifact Signatures - Oshi Gupta & Sagar Utekar
Keycloak Sigstore Fulcio Oidc Container signing Software supply chain Artifact security Keyless signing Cloud native security Identity management
This talk demonstrates how to integrate Keycloak as the OIDC provider for Sigstore's keyless signing flow, enabling organizations to bind artifact signatures to human and service identities managed in their own identity infrastructure rather than third-party providers like GitHub or Google. Covers Fulcio configuration, Keycloak realm and client setup, and addresses operational challenges including token expiry during long builds, claim mapping issues, and service identity handling for automated pipelines. For DevOps engineers and security teams implementing software supply chain security.
Related videos
Sponsored Keynote | Midships Global: You Don't Need a New Identity Platform for the AI Era - Y. Lin
Navigating the Identity Abyss in the AI‑Native Era - Yuichi Nakamura, Hitachi
No More Secrets With Keycloak's Federated Client Authentication - Rishabh Singh, Red Hat
Lightning Talk: Surviving Certificate Expiry in Enterprise Keycloak: Per-Client Key… H. Wada
Simple Control: Managing Multi-Domain MCP Access Via Keycloak IdP With ID-JAG - Yutaka Obuchi
Securing Non-Human Identities: A Defense-in-Depth Blueprint for AI Agents - Tatsuya Yano
Commit-Then-Disclose: Cryptographic SBOM Auditing Without IP Leakage - Sharvil Bhatt & Swastik Gour
Lightning Talk: Using Keycloak Authorization Service for Kubernetes Service-to-Service… H. Özkan
MCPIdentity: Keyless MCP Agent Authentication Patterns on Kubernetes With Keycloak… M. Dayıoğlu
Lightning Talk: What Is New and Coming for Managing Cloud Native Identities in… A. Schwartz
Why Enterprise AI Is Really an Infrastructure Problem | Colton, Spectro Cloud
