Why Not Use Keycloak?

Someone asked the question on our call today: "_why don't we just use `keycloak` for auth_?"

https://github.com/keycloak/keycloak

In a single word: `Security`
https://github.com/keycloak/keycloak/security

`Session hijacking`, `DoS`, `XSS`, Leak of LADP, Path traversal ... 😬
Unless you plan to _actively_ maintaining your `keycloak` instance with regular updates,
it's only a matter of time before another critical vulnerability appears and your auth is hacked.

It's a _good_ thing that `RedHat` are using it: https://access.redhat.com/products/red-hat-build-of-keycloak
Means that security-minded people have their eyes on it. 👀
But unless you have a system to _automatically_ update and reboot your instance, it will get out-of-date _fast_!