The Graphwise Platform Security Model

13/07/2027

The Graphwise Platform (GWP) security model defines a scalable, secure, and maintainable approach to authentication and authorization. It is built on OAuth 2.0 and OpenID Connect (OIDC), with Keycloak as the single trust anchor. The architecture addresses:

Support of external identity providers (e.g., Azure AD, SAML, LDAP)
Human user access and system/service access
Multi-hop service calls without user impersonation
HTTP header and token size constraints
GraphDB-specific security requirements

The GWP security model provides a single, authoritative IdP (Keycloak), client-scoped tokens, and per-application authorization. It supports SSO, federation, and both internal and external M2M access via service accounts. Default realm artifacts accelerate deployment, while strict audience scoping, HTTPS, token expiry, and key rotation help ensure production-grade security.

Tip

Refer to the original Keycloak documentation for more details.

In this section: