Keycloak

Overview

Keycloak is an open-source identity and access management platform, primarily maintained by Red Hat and widely deployed by enterprises and developers as a self-hosted or cloud-managed SSO solution. When a web application integrates Keycloak for authentication, the Keycloak JavaScript adapter runs in the browser to manage login flows, session state, and token lifecycle. Its presence on a website indicates that Keycloak is the identity provider for that application.

What This Script Does

Keycloak's browser-side adapter (keycloak.js or keycloak.min.js), served from the Keycloak server domain, handles OpenID Connect and OAuth 2.0 flows in the browser. It manages redirect-based login sequences, receives authorization codes and tokens after authentication, and stores tokens in memory or sessionStorage / localStorage depending on configuration.

Keycloak sets several cookies at the authentication server domain:

• KEYCLOAK_SESSION — a session identifier cookie, HttpOnly, scoped to the Keycloak server domain, with expiry matching the SSO session lifetime (typically hours to days)
• KEYCLOAK_IDENTITY — an identity token cookie, similarly scoped and HttpOnly
• AUTH_SESSION_ID — used during the login flow to maintain state across redirects; typically session-scoped

These cookies are set on the Keycloak server's domain (e.g., auth.example.com), not the application domain directly. The adapter makes requests to Keycloak's token and userinfo endpoints to validate sessions and refresh access tokens transparently.

No advertising data, behavioral analytics, or third-party sharing occurs. The adapter's sole purpose is authentication and session maintenance for the specific application.

Consent & Compliance

Keycloak falls squarely in the essential category. Authentication cookies are explicitly exempt from ePrivacy consent requirements under the "strictly necessary" exception — they are required to deliver the service the user has actively requested (logging in). Without these cookies and the associated script, the user cannot authenticate.

Under GDPR, the lawful basis for processing authentication data is contract (Article 6(1)(b)) — processing is necessary to perform the service the user has signed up for. No separate consent is needed for authentication session management.

Under CCPA/CPRA, authentication data is generally not subject to opt-out rights because it is not sold or shared and is necessary for service delivery. Operators deploying self-hosted Keycloak process data on their own infrastructure; those using cloud-hosted Keycloak (e.g., Red Hat SSO or third-party Keycloak hosting) should execute a DPA with the hosting provider.

Should You Block This Without Consent?

No. Keycloak scripts and cookies are strictly necessary authentication infrastructure. Blocking them would prevent users from logging into the application — a functional outcome that violates the basic service contract. They are exempt from ePrivacy consent requirements and should be categorized as essential, always-on scripts.