Keycloak provides Authentication SPI, which allows to choose the AuthenticationProvider for authenticating users. AuthenticationProvider is the interface, which states how will be your usernames/passwords validated. You can choose from the set of available AuthenticationProviders or you can even implement and plug your own AuthenticationProvider, which will allow to provide your own way how will Keycloak validates users and their passwords.

Model - This provider validates users and their passwords based on the Keycloak model. So it just delegates to model implementation provided either by RDBMS or Mongo at this moment. This is default AuthenticationProvider, which is configured for keycloak-admin realm by default and it's also automatically configured for newly created realms. External-model - This provider also uses Keycloak model, but it uses different realm to validate your users against. For example if you want to create new realm "foo" and you want all users of already existing realm "bar" that they are automatically able to login into realm "foo" with their usernames and passwords, you can choose this provider. Picketlink - This provider delegates Authentication to Picketlink IDM framework. Right now, Picketlink IDM in Keycloak is configured to always use LDAP based Identity store, which means that picketlink provider allows you to authenticate your users against LDAP server. Note that you will first need to configure LDAP server as described here . PicketlinkAuthenticationProvider configured for the realm will automatically use LDAP configuration for this realm.

You can configure AuthenticationProviders separately for each realm. So for example you can choose that just realm "foo" will use PicketlinkAuthenticationProvider and authenticate users against LDAP but realm "keycloak-admin" will still use default ModelAuthenticationProvider. There is also possibility to choose more authentication providers for the realm, which actually means that Keycloak will use first available AuthenticationProvider and just in case that user doesn't exist here, it will fallback to second AuthenticationProvider in chain. So this may allow for example scenario, in which you authenticate user against Keycloak database (model) and just if he doesn't exist in database, it will fallback to LDAP (picketlink). You can configure for each AuthenticationProvider if you want to update passwords - option passwordUpdateSupported. This means that when user update password or his profile through Keycloak UI, this change will be propagated into AuthenticationProvider. So for example password in LDAP will be updated if it's true, but for read-only LDAP, you will likely switch it to false. It also means that newly registered users will be propagated to particular AuthenticationProvider too, but note that each user is always bind just to one AuthenticationProvider. You can add/edit/remove AuthenticationProviders in the Authentication tab in admin console, which is under URL http://localhost:8080/auth/admin/keycloak-admin/console/#/realms/YOUR_REALM/auth-settings

You need to implement interface AuthenticationProvider and add the name of your AuthenticationProviderFactory class into META-INF/services/org.keycloak.authentication.AuthenticationProviderFactory file inside your JAR with AuthenticationProvider. You also need to copy this JAR into standalone/deployments/auth-server.war/WEB-INF/lib . The best is to look at example and try it out.