As suggested on the Apache Isis mailing list.
There are several approaches ...
As described in our security guide  Apache Isis has a pluggable API for
both authentication and authorization, so at the lowest level one could
take implement either/both of these plugin points.
Apache Isis has two integrations, one for Shiro and one called "bypass"
(which basically disables security). So one could ignore Apache Isis'
Shiro integration and implement everything yourself.
However, it would probably make more sense to build
upon the Isis Add-ons security module , which builds upon the Shiro
integration by providing an implementation of a Shiro Realm. This is
described in . In fact, I would suggest that keycloak would be used as
a delegate realm within the Isis addons' security module.
In other words, the design that we could use is:
Apache Isis -> Shiro -> Isis addons security realm -> Isis addons
This last realm would be implemented using Keycloak.
The documentation in the security module  and  might also help to
Note that this design would use Keycloak for authentication (validate
credentials and lookup roles), with the security module taking
responsibility for authorization.
- mentioned in