HES LoanBox and Keycloak connected

HES LoanBox is a back-end platform with several portals: Borrower Portal, BackOffice Portal, Agent Portal, plus a machine-to-machine integration API. None of the portals show a LoanBox-owned login screen — every sign-in is handled by Keycloak.

Key characteristics

• Keycloak is the source of truth for users. A user account, password, phone, email, password reset, account deactivation, and temporary password handling all live in Keycloak. HES LoanBox never stores a password.
• One realm per portal. Each portal authenticates against its own isolated Keycloak realm. Users from one realm cannot access another portal:

• Single sign-on is token-based. After a user signs in to Keycloak, HES LoanBox accepts a short-lived security token on every request and reads the user’s name and roles from it. There are no LoanBox-side login sessions.
• Roles drive what a user can do. HES LoanBox checks the roles carried in the token at every endpoint and at every step inside business processes. If the role does not permit the action, the action is rejected.
• The platform creates some users automatically. Borrowers and agents are created in Keycloak by HES LoanBox itself during the application and agent-invitation flows. All other users — back-office staff, integration clients, analytics users, administrators — are created directly in Keycloak by an administrator.

Relationship with related concepts

• A Borrower profile in HES LoanBox is paired with a Keycloak user account. The Keycloak user holds the credentials; HES LoanBox holds the application and loan data.
• An Agent record in HES LoanBox is paired with a Keycloak user under a specific partner organization. The partner identifier is stored as a Keycloak attribute on the user so the Agent Portal can scope data correctly.
• A Staff user is a Keycloak user in the Backoffice realm with one or more backoffice roles. The platform does not store a separate staff profile — the role in Keycloak is enough.