€1M
Annual savings across European clients
Software licensing savings of up to €1M per year for some of our clients.
Rated 4.87/5 on Sortlist★★★★★
Scroll to exploreEnterprise access management with Keycloak
Assess your identity architecture and define a Keycloak integration plan, from application access to operational ownership.
Start with the identity landscape you already run
A Keycloak engagement starts by reviewing applications, identity providers, directories and access rules. We propose a target architecture and a bounded implementation scope with your engineers. Published billing and integration references describe adjacent engineering work; they do not establish a delivered Keycloak migration.
Agree the first assessment
Inputs, outputs and limits
Share architecture diagrams, applications and directories, the role model, traffic expectations and the people responsible for operations. The first deliverable is a scoped assessment and proposed pilot. It does not include a production migration, a certification or a guarantee of uninterrupted login.
DNA Solutions by the numbers
Company-wide DNA Solutions figures. These are not results from a particular IAM or Oracle project.
A senior team of engineers and consultants across Europe.
€300M
Monthly audited transactions
We built and maintain a Deloitte-audited billing platform processing €300M in audited transactions every month.
6 years
Long-term client relationships
Several clients have worked with DNA Solutions for six years. We continue to develop and support their software as their needs evolve.
Identity engineering for enterprise platforms
The proposed implementation scope can include SSO, directory federation, access policies and provider migration. Dependencies, security requirements and acceptance tests are agreed before changes begin.
What We BuildMulti-tenant SSO architecture
Identify which applications share a login and which tenants require isolation. Compare realms, organizations and federation against your access requirements. Realm and client configuration alone does not enforce every application permission.
Role-based access control (RBAC)
Document roles, resources and permission checks. Applications and APIs must validate tokens and enforce access decisions; putting a role in a token is insufficient on its own. Test forbidden access as well as successful logins.
Legacy identity provider migration
Inventory account identifiers, credential formats and external dependencies before choosing federation, import or phased migration. Parallel operation is considered where feasible. Cutover, rollback and any login interruption must be rehearsed and agreed.
How we secure users, roles and permissions
The proposed implementation scope can include SSO, directory federation, access policies and provider migration. Dependencies, security requirements and acceptance tests are agreed before changes begin.
SSO and tenant boundaries
Identify which applications share a login and which tenants require isolation. Compare realms, organizations and federation against your access requirements. Realm and client configuration alone does not enforce every application permission. Document the isolation decision, its trade-offs and the applications covered by the pilot.
Application authorization
Document roles, resources and permission checks. Applications and APIs must validate tokens and enforce access decisions; putting a role in a token is insufficient on its own. Test forbidden access as well as successful logins. Review the access model with the business owners responsible for each resource.
Identity provider transition
Inventory account identifiers, credential formats and external dependencies before choosing federation, import or phased migration. Parallel operation is considered where feasible. Cutover, rollback and any login interruption must be rehearsed and agreed. Record any required user actions and who authorizes each transition step.
Sessions and operations
Define MFA requirements, token expiry, logout behavior, event logging, upgrade tests and incident ownership. Token revocation behavior depends on the applications and validation method. Include database recovery and availability in the operational plan. Assign service owners and a recovery objective before selecting the deployment topology.
Access management shaped by your sector
For shared enterprise platforms, the assessment checks partner federation, tenant isolation and application permissions against the actual operating model.
Telecom & Media
Multi-tenant identityReview identity sources, tenant boundaries and application access in the existing operating model.
OSS / BSSPartner portalsFederation
Explore telecom → 
Toll & Road Infrastructure
Centralized access controlReview identity sources, tenant boundaries and application access in the existing operating model.
Consortium accessCross-operatorRBAC
Explore tolling → 
System Integration
Same engineering familyReview identity sources, tenant boundaries and application access in the existing operating model.
Directory federationAPI accessSSO
Explore integration →What clients and partners value about DNA Solutions
Selected reviews from clients and partners about working with DNA Solutions.
"Collaboration with DNA is great they listen and know our industry inside out and they are both reactive to requests and proactive with ideas and proposals"
"The real connection between sales and project delivery. Most IT companies have salespeople who communicate poorly or not at all with the people who actually build the solution; at DNA, that is really not the case."
"The quality of the people I worked with and the rigour of the project management. The company's very human side is also remarkable."
Questions about IAM and Keycloak
Common questions on Keycloak, migration and multi-tenant access.
What is included in an initial Keycloak assessment?
Provide an application inventory, identity-provider and directory configurations, a role matrix, tenant boundaries and operational constraints. The proposed outputs are an identity map, a target architecture, a dependency and risk register, and a scoped pilot with acceptance criteria. Implementation is a separate, agreed phase.
Why consider Keycloak?
Keycloak supports standards such as OpenID Connect and SAML, federation and identity brokering. Its open-source licensing differs from managed IAM subscriptions. Hosting, operations, upgrades, extensions and support still have costs; suitability depends on your requirements and team.
Can an identity migration guarantee uninterrupted access?
The assessment determines which transition is feasible. Credential compatibility, application behavior and external providers can require user action or an agreed interruption. We define tests, a cutover window and recovery procedures before a migration is approved.
How is multi-tenant isolation verified?
The architecture must define identity and application-data boundaries. Tests verify that one tenant cannot access another tenant’s resources, including through APIs, administration and background jobs. Keycloak configuration supports that design but does not replace enforcement in the applications.