iamfilip

About

Photo of Filip

Hi, I’m Filip, an Identity & Access Management engineer in Vienna, Austria.

I’ve been building and running software for more than 15 years: backend services, distributed systems, cloud infrastructure and platform engineering. Along the way I kept ending up at the same place: the login page, the token, and the question of who is allowed to do what. Today that’s my full-time job at a large European retailer, mostly with Keycloak:

  • Clients: OpenID Connect and SAML applications that rely on Keycloak to log people in and to authorize service calls.
  • Identity brokering: Microsoft Entra ID as an identity provider in Keycloak realms, so employees sign in with the accounts they already have.
  • Operations: running Keycloak highly available on Kubernetes in Google Cloud, from deployment and clustering to upgrades.

What I’m interested in#

  • OAuth 2.0 and OpenID Connect in practice: token exchange, audiences, scopes, and the claim checks APIs forget.
  • Authorization: going from roles to fine-grained, policy-based decisions.
  • AI agents: how an agent proves who it is, acts on a user’s behalf, and gets only the permissions its task needs. Token exchange and delegation are where that starts.

Why this blog#

I write the posts I wish I had found while learning: how things actually work, which settings matter, and what breaks in production.

  • Hands-on. Every post that can have a lab has one. The labs live in iam-lab on GitHub: Keycloak in Docker, configured with Terraform, so you can see exactly what was set up.
  • Current. Keycloak moves fast. I mention the version I tested against and update posts when behavior changes.
  • Honest. I don’t have all the answers. When something depends on context, I say what it depends on, and when I get something wrong, I fix it.

I’ll also write about where identity is heading, especially how authorization has to change once AI agents call APIs on people’s behalf.

Say hello#

If you work on IAM, application security or agentic systems, I’d be happy to exchange ideas. Connect with me on LinkedIn, follow along on GitHub, or open an issue if you spot a mistake.