Why your Keycloak or Okta server is worth decoy-ing
· 4 min read
An identity provider (IdP) is one of the highest-value targets in any environment. Whoever controls Keycloak, Okta, or Active Directory controls every user account. Attackers know this, and they look for IdP admin consoles early in an intrusion.
What an attacker wants from your IdP
The goal is usually one of three things: creating a new admin account that persists after the initial access is cleaned up, resetting the password of a privileged user, or extracting credentials from the user store. In Keycloak terms, that means hitting the admin REST API (e.g. GET /auth/admin/realms/master/users) or trying to obtain a token via the password grant at /auth/realms/master/protocol/openid-connect/token.
Why a fake IdP works well as a decoy
A real Keycloak or Okta server is heavily monitored and behind strict access controls. A fake one is not, which is exactly why an attacker will try it. The admin console looks identical. The OIDC discovery endpoint returns plausible JSON. The token endpoint accepts credentials and returns a 401 — the same response a real server gives on a wrong password.
Every login attempt against the decoy is a detection event. Every call to the admin REST API is a high-severity incident: someone is trying to list users, create accounts or modify roles. That is unmistakably malicious — no administrator has a reason to hit an admin API endpoint they didn't know was there.
Catching CVE probes too
Many automated scanners test for known Keycloak vulnerabilities (authentication bypasses, SSRF in earlier versions) by probing specific paths before attempting a login. A decoy Keycloak catches those probes and tells you someone is running an automated tool against your infrastructure, often before a human attacker has even looked at the results.
The same logic applies to Okta, Azure AD Connect, and any other IdP your organisation runs. A decoy next to the real one catches reconnaissance, credential stuffing and admin API abuse.
Read about what happens when attackers find your secrets manager, or deploy the Keycloak profile.