# Security & Identity Source: https://forgeone.solutions/en/security-identity Language: en Published: 2026-09-04 Updated: 2026-10-14 ForgeOne designs identity, SSO and security solutions for Linux, Kubernetes and open source with Keycloak, FreeIPA, OIDC, SAML and PKI. ## Security & Identity Central identities, clear permissions and secure administrative access are the foundation for resilient Linux, Kubernetes and open-source platforms. ForgeOne designs identity, SSO and security solutions for Linux, Kubernetes and open-source infrastructures with Keycloak, FreeIPA, OIDC, SAML and PKI. - Identity provider, directory and federation are clearly separated. - Local admin accounts are replaced with traceable roles. - SSO and MFA connect applications, platforms and operations. - PKI, certificates and secrets receive clear lifecycle processes. - [Book a consultation](https://forgeone.solutions/en/contact#book-appointment) ## Typical challenges Security problems often emerge where identities have grown historically: local accounts, multiple login systems, manual certificates and unclear service accounts. ### Multiple identity sources Users are maintained in separate systems. Roles, groups and lockouts are therefore inconsistent. ### Local admin accounts Administrative access lives on individual systems and is hard to review or revoke. ### No central MFA/SSO Applications, Linux systems and platforms use different login mechanisms. ### Historical service accounts Machine identities and tokens have been created over years but are not properly documented. ### Manual certificates Certificates are renewed ad hoc. Trust chains and expiration dates are not transparent. ### Unclear roles Permissions exist technically but are not tied to responsibilities and least privilege. ## Identity and security architecture ## Identity provider, directory and federation ForgeOne separates the building blocks intentionally: a directory stores system identities and groups, an identity provider controls modern web and application sign-ins, and federation connects existing identity sources in a controlled way. FreeIPA fits Linux and system identity with Kerberos, LDAP, host policies and PKI. Keycloak is strong for web identity, OIDC, SAML, MFA, SSO and federation. No component has to replace everything artificially. - FreeIPA and Red Hat IdM for Linux identity - Keycloak and Red Hat build of Keycloak for application identity - OIDC, SAML, LDAP, Kerberos and federation - MFA, session management and central sign-in ## Access control and administrative access RBAC, groups, roles, sudo rules, HBAC, service accounts and machine identities must be considered together. The goal is not maximum complexity but clear responsibility and reviewable permissions. Administrative paths are documented and hardened: who may access what, how access is approved, logged and revoked. - RBAC and least privilege - sudo rules, HBAC and host enrollment - Service accounts and machine identities - Secrets, tokens and controlled admin access ## PKI, certificates and hardening PKI is more than issuing certificates. Internal trust chains, service certificates, expiration dates, renewal and platform integration must work in operations. Security hardening stays practical: SELinux, CIS-oriented baselines, SSH/PAM, secure defaults and Zero Trust principles are implemented according to the platform. - Internal trust chains and service certificates - Automated renewal where appropriate - SELinux, CIS, SSH/PAM and secure defaults - Integration with Linux, Kubernetes and collaboration platforms ## Boundary to security services Security & Identity is the solution overview for technical identity and access concepts. Reviews and delivery services remain separate service pages. For reviews and tests, the overview links to Security Assessment, Kubernetes Security Assessment, Managed Security and Penetration Testing without duplicating those pages. - Solution overview: architecture and technical platform topics - Services: assessment, review, penetration testing and managed security - Detail pages: SSO, Directory Services, Access Policies and Network Design ## What customers receive ## Scope-dependent results Depending on the starting point, the result can be an identity architecture, SSO integration, directory integration, a role and permission model, PKI integration or a hardening baseline. ForgeOne documents access paths so operations, security and application teams use the same language. This reduces dependency on individuals and makes audits more reliable. - Identity architecture and integration concept - SSO and MFA integration - Directory and role model - PKI and hardening baseline ## Operations and evolution Identity is not a one-time project. Roles change, applications are added, certificates expire and platforms evolve. ForgeOne therefore includes lifecycle, documentation, handover and optionally ongoing operations. Existing systems are integrated when they are sound instead of being replaced reflexively. - Lifecycle for roles, certificates and service accounts - Documented operating processes - Integration of existing identity sources - Optional managed security or co-managed operations ## Further orientation ## Related services These services explain how ForgeOne plans, implements or operates the solution. - Security Assessment - Kubernetes Security Assessment - Managed Security - Penetration Testing [Security Assessment](https://forgeone.solutions/en/security-assessment-configuration-review) ## Technologies and products The selection shows relevant platforms without turning the overview into a product catalogue. - Keycloak - FreeIPA - Red Hat Identity Management - Red Hat build of Keycloak [Keycloak](https://forgeone.solutions/en/products/keycloak) ## Detail pages Detailed pages explain individual requirements and technical decisions in more depth. - Identity Management - Single Sign-On - Directory Services - Access Policies - Network Design [Identity Management](https://forgeone.solutions/en/identity-management-idm) ## Technical insights Selected articles provide context, examples and technical perspective. - grommunio-auth with Keycloak and SSO - Responsible Disclosure and security.txt [grommunio-auth with Keycloak and SSO](https://forgeone.solutions/en/tech/grommunio-auth-centralized-authentication-with-keycloak-and-existing-sso) ## Practice, Operations and Governance ## Adoption logic Identity projects become more stable when the real access paths are visible first: human users, admin access, service accounts, machine identities, technical applications and certificate dependencies. ForgeOne models these paths before making tool decisions. This clarifies the role of directory services, identity providers, federation, MFA, PKI and secrets management. - Access inventory and identity sources - Role model and least privilege - SSO/MFA target model - PKI and certificate lifecycle ## Operating model After rollout, roles, certificates, groups, federation rules and service accounts still need maintenance. Without lifecycle, local exceptions and historical special cases return. ForgeOne therefore connects identity architecture with operating documentation, review routines and clear responsibilities. Security becomes not only technically implemented but permanently governable. - Review of roles and groups - Revocation and expiration of access - Auditable admin paths - Documented federation and certificate processes ## FAQ ### What is the difference between FreeIPA and Keycloak? FreeIPA is strong for Linux and system identities with LDAP, Kerberos, host policies and PKI. Keycloak is strong for web and application identity with OIDC, SAML, SSO, MFA and federation. ### Does an existing directory need to be replaced? Not automatically. Federation or integration is often more sensible than a big-bang replacement. ### Is MFA part of this? Yes, when central sign-in and the risk profile require it. MFA is aligned with applications, admin access and operating processes. ### How are service accounts handled? Service accounts and machine identities are inventoried, documented, permissioned and governed with lifecycle rules. ### Is network design part of this topic area? Only partly. Network Design remains a detail page and is linked where security and platform architecture overlap. ## Bring identities and access under control - [Book a consultation](https://forgeone.solutions/en/contact#book-appointment)