Enterprise Identity Stack
Interactive Study Guide

eIDAS Node is a real EC reference implementation

The European Commission publishes the CEF eIDAS-Node software (current pre-release: v2.7.0, licensed EUPL 1.2). Member States are not required to use it — they can build their own node compliant with the technical specs — but many do adapt and reuse it. The reference implementation is Java/Tomcat-based, not a Docker-ready microservice. Production deployments require significant hardening.

Source: EC Digital Building Blocks, CEF eIDAS-Node Integration Package v2.5+ (2020–2024)

eIDAS Regulation (EU) No 910/2014 is law

The base eIDAS regulation is real and in force across all 27 EU Member States. The LoA levels (Low / Substantial / High) are defined in Commission Implementing Regulation (EU) 2015/1502. The notified IdPs listed (BundID, FranceConnect+, Cl@ve, BankID) are real notified schemes as of 2024.

Source: EUR-Lex, eIDAS Regulation full text; EC eIDAS notified eID schemes list

eIDAS 2.0 / EU Digital Identity Wallet is enacted

Regulation (EU) 2024/1183 (eIDAS 2.0) was adopted. Member States must offer at least one EUDI Wallet. Implementing regulations (CIR 2024/2977, 2024/2981, 2025/846) were published through July 2025. The ARF (Architecture Reference Framework) governs technical interoperability. SD-JWT VC and OpenID4VP are the credential protocols.

Source: EC EUDIW portal, OJ 2024/1183, ARF v1.x (eu-digital-identity-wallet.github.io)

Keycloak OIDC + Django mozilla-oidc integration is standard

mozilla-django-oidc is a well-maintained library (Mozilla, Apache 2.0). The ClaimsBackend pattern shown is the officially recommended approach. RS256 is the correct algorithm for production — symmetric HS256 is only for testing. The 5-minute access token TTL shown reflects Keycloak defaults, which are sane for production.

Source: mozilla-django-oidc docs; Keycloak 24 documentation; RFC 7519 (JWT)

eIDAS Node is NOT a simple Docker container

The simulator shows eIDAS as a clean microservice you plug in. Reality: the CEF reference implementation is a Java EE application requiring Tomcat, complex XML configuration, SAML2 metadata exchange with the EC's MDSL (Metadata Service List), and notified scheme-specific Specific Connector modules. The Sweden Connect mock on GitHub is the closest thing to a testable Docker setup — and it's explicitly marked test/demo only.

Architecture varies wildly by organization size

This stack (Keycloak + Django + Nginx) is reasonable for a mid-size team. Larger enterprises often: (a) run Keycloak in HA mode with Infinispan clustering and external DB, (b) put an API gateway like Kong or AWS ALB in front instead of Nginx, (c) use Keycloak Operator on Kubernetes rather than Docker Compose, (d) integrate with Active Directory/LDAP federation instead of Entra OIDC directly.

Authentik is not a full Entra replacement

Authentik is excellent for self-hosted SSO and handles OIDC/SAML2/SCIM well, but it does not replicate Entra's Conditional Access risk scoring, Defender for Identity threat signals, or PIM (Privileged Identity Management). For air-gapped environments it's the right choice. For full corporate IAM with compliance requirements, Entra (or Okta/Ping) has features Authentik lacks.

eIDAS LoA High requires legal/procurement process

You cannot connect to the live eIDAS network by writing code. Your organisation must be a notified service provider in the Member State(s) you operate in. This involves a national conformity assessment, registration with the national supervisory body, and for public sector services, often a public procurement process. The simulator models the technical protocol — not the governance layer.

Token simulation is illustrative — signatures are fake

The JWT payloads in the Token Lab are correctly structured and use realistic claim names from the OIDC Core spec and eIDAS attribute profile. However, the "signature" shown is descriptive text — no actual RSA key pair is used. Do not use these token structures verbatim without validating against your Keycloak realm's actual JWKS endpoint.

eIDAS Regulation

Regulation (EU) No 910/2014

eur-lex.europa.eu/legal-content/EN/ALL/?uri=uriserv:OJ.L_.2014.257

eIDAS 2.0

Regulation (EU) 2024/1183 — EUDI Wallet

ec.europa.eu/digital-building-blocks/eudiw

CEF eIDAS-Node

EC Reference Implementation v2.5+ (EUPL 1.2)

ec.europa.eu/cefdigital/wiki → eIDAS Node Integration Package

Keycloak

Keycloak 24 Documentation (Red Hat)

keycloak.org/documentation

OAuth 2.1 / PKCE

OAuth 2.1 draft + RFC 7636 (PKCE)

datatracker.ietf.org/doc/html/rfc7636

OIDC Core

OpenID Connect Core 1.0 Spec

openid.net/specs/openid-connect-core-1_0.html

mozilla-django-oidc

Mozilla OIDC library for Django

mozilla-django-oidc.readthedocs.io

JWT / JWS

RFC 7519 (JWT), RFC 7515 (JWS), RFC 7517 (JWK)

datatracker.ietf.org/doc/html/rfc7519

OAuth Threat Model

RFC 9700 — OAuth 2.0 Security Best Current Practice

datatracker.ietf.org/doc/html/rfc9700

AWS stack

Cognito User Pools + Identity Pools → API Gateway → Lambda/ECS. No Keycloak. Federation via SAML2 or OIDC to Cognito. Common in AWS-native orgs but vendor lock-in is high and Cognito's OIDC compliance has quirks.

Okta / Auth0 enterprise

Fully managed. Okta Universal Directory handles user store. Auth0 handles the OIDC/SAML flows. Expensive at scale but zero ops burden. Standard for US enterprise, less common in EU public sector due to data residency concerns.

Keycloak + Quarkus (next post)

Replace Django with Quarkus microservices. Use the quarkus-oidc extension for zero-config JWT validation. Deploy Keycloak and Quarkus as native images on GraalVM. Dramatically lower memory footprint — relevant for EU public sector cloud deployments.

Spring Security + Keycloak

The Java-native path. spring-boot-starter-oauth2-resource-server handles JWT validation. Keycloak's Spring adapter was deprecated — use the resource server approach directly. Common in enterprises already on Spring Boot.

Bare metal Entra-only

Skip Keycloak entirely. Apps register directly in Entra, use MSAL for token acquisition. Works if 100% of your users are in M365. Breaks when you add non-Microsoft apps, legacy SAML, or eIDAS — which is why Keycloak as a broker adds value.