Porting Azure AD B2C custom policies to Keycloak
Most of an Azure AD B2C custom policy maps onto Keycloak configuration rather than code. A user journey becomes an authentication flow, orchestration steps become executions, preconditions become conditional subflows, the claims schema becomes the declarative user profile, and page layouts become themes. None of that is Java.
Three things are not configuration. RESTful technical profiles called mid-journey become a custom Authenticator. Long claims-transformation chains become either several protocol mappers or one script mapper — and the script mapper is a JAR you build, not JavaScript you paste into the console, which surprises people. And orchestration that branches on a computed value rather than on the presence of a claim has no declarative equivalent at all.
Everything below was run against Keycloak 26.8.1 in start-dev. The Java compiles against
26.8.1; every HTTP status and response body is copied from an actual run.