diff --git a/docker-compose.yml b/docker-compose.yml
index 148b0c3..65dccaf 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -14,6 +14,7 @@
       - "80:80"
       - "443:443"
     networks:
+      - kcnet
       - simpleidnet
       - gerritnet
     volumes:
@@ -34,6 +35,30 @@
       - ./postgres/init.sh:/docker-entrypoint-initdb.d/init.sh:ro
       - ./postgres/data/:/var/lib/postgresql/data/:rw
       - ./postgres/passwd/:/tmp/passwd/:rw
+  keycloak:
+    build:
+      context: ./keycloak/docker/
+      args:
+        - KC_DB=postgres
+    networks:
+      - kcnet
+      - dbnet
+    env_file: environment
+    environment:
+      - KC_PROXY=edge
+      - KC_HOSTNAME_DEBUG=true
+      - KC_HOSTNAME_STRICT=true
+      - KC_HOSTNAME_STRICT_BACKCHANNEL=true
+      - KC_HOSTNAME_URL=https://id.${SA_PUBLIC_DOMAIN_NAME}/
+      - KC_HOSTNAME_ADMIN_URL=https://id.${SA_PUBLIC_DOMAIN_NAME}/
+      - KC_DB_USERNAME=keycloak
+      - KC_DB_URL_HOST=postgres
+      - KC_DB_URL=jdbc:postgresql://postgres/keycloak
+      - KC_DB_POOL_MAX_SIZE=16
+      - KEYCLOAK_ADMIN=deusarcadia
+      - KEYCLOAK_ADMIN_PASSWORD=arcanumhomini
+    volumes:
+      - ./postgres/passwd/keycloak/:/tmp/passwd/db/:ro
   simpleid:
     build:
       context: .
@@ -88,6 +113,7 @@
       - "993:993"  # IMAP4 (implicit TLS)
     networks:
       - gerritnet
+      - kcnet
     volumes:
       - ./logs/mail-supervisor/:/var/log/supervisor/:rw
       - ./logs/mail/:/var/log/mail/:rw
@@ -123,3 +149,8 @@
     ipam:
       config:
         - subnet: 10.12.14.40/29
+  kcnet:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 10.12.14.48/29
diff --git a/keycloak/docker/Dockerfile b/keycloak/docker/Dockerfile
new file mode 100644
index 0000000..84c07dd
--- /dev/null
+++ b/keycloak/docker/Dockerfile
@@ -0,0 +1,27 @@
+ARG KC_TAG=22.0
+FROM quay.io/keycloak/keycloak:${KC_TAG} as builder
+
+# Enable health and metrics support
+ENV KC_HEALTH_ENABLED=true
+ENV KC_METRICS_ENABLED=true
+
+ARG KC_DB=
+RUN test "${KC_DB}" || { echo \${KC_DB} must be set!; exit 1; }
+
+WORKDIR /opt/keycloak
+# for demonstration purposes only, please make sure to use proper certificates in production instead
+RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname "CN=server" -alias server -ext "SAN:c=DNS:idm.test.hfh-it.de,IP:192.168.44.11" -keystore conf/server.keystore
+RUN /opt/keycloak/bin/kc.sh build
+
+
+FROM quay.io/keycloak/keycloak:${KC_TAG}
+
+COPY --from=builder /opt/keycloak/ /opt/keycloak/
+
+USER root
+COPY entrypoint /sa-entrypoint
+RUN chmod 544 /sa-entrypoint
+
+USER keycloak
+ENTRYPOINT ["/bin/sh", "/sa-entrypoint"]
+CMD ["start", "--optimized"]
diff --git a/keycloak/docker/entrypoint b/keycloak/docker/entrypoint
new file mode 100644
index 0000000..772add0
--- /dev/null
+++ b/keycloak/docker/entrypoint
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+set -e
+
+{
+    db_secret=/tmp/passwd/db/secret
+
+    i=0
+    while [ -z "$(cat ${db_secret} 2>/dev/null)" ]; do
+        if [ ${i} -eq 10 ]; then
+            echo "ERROR: No password file after ${i}s."
+            exit 1
+        fi
+        sleep 1
+        i=$((i+1))
+    done
+
+    export KC_DB_PASSWORD=$(cat ${db_secret})
+}
+
+exec /opt/keycloak/bin/kc.sh "$@"
diff --git a/nginx/sa.conf b/nginx/sa.conf
index 0a20f36..4022254 100644
--- a/nginx/sa.conf
+++ b/nginx/sa.conf
@@ -30,6 +30,16 @@
         fastcgi_index index.php;
         fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
     }
+
+    location /auth/ {   # Gerrit adds this prefix for Keycloak...
+        rewrite ^/auth(.*)$ $1 last;
+    }
+
+    location / {
+        proxy_pass          http://keycloak:8080;
+        proxy_set_header    X-Forwarded-For $remote_addr;
+        proxy_set_header    Host $host;
+    }
 }
 
 server {
diff --git a/postgres/docker/entrypoint b/postgres/docker/entrypoint
index 311a019..1782d31 100644
--- a/postgres/docker/entrypoint
+++ b/postgres/docker/entrypoint
@@ -11,7 +11,7 @@
         echo $(mktemp -u XXXXXXXXXXXXXXXX) >${kc_secret}
     fi
     chown root:postgres ${kc_secret}
-    chmod 440 ${kc_secret}
+    chmod 444 ${kc_secret}
 }
 
 exec docker-entrypoint.sh "$@"
diff --git a/postgres/init.sh b/postgres/init.sh
index dc0d510..6ef8e46 100755
--- a/postgres/init.sh
+++ b/postgres/init.sh
@@ -7,8 +7,7 @@
     kc_password=$(cat ${kc_secret})
 
     psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
-	CREATE USER keycloak WITH PASSWORD '${kc_password}';
-	CREATE DATABASE keycloak;
-	GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;
+	CREATE USER keycloak WITH ENCRYPTED PASSWORD '${kc_password}';
+	CREATE DATABASE keycloak WITH ENCODING='UTF8' OWNER keycloak;
 EOSQL
 }