diff --git a/deployments/examples/ocis_keycloak/.env b/deployments/examples/ocis_keycloak/.env
new file mode 100644
index 0000000000..6afeab223b
--- /dev/null
+++ b/deployments/examples/ocis_keycloak/.env
@@ -0,0 +1,25 @@
+### traefik settings ###
+# domain of treafik, where you can find the admin panel. defaults to trefik.owncloud.local
+#TRAEFIK_DOMAIN=
+# basic authentication for the treafik admin panel. defaults to admin:admin
+#TRAEFIK_BASIC_AUTH_USERS=
+# email address for obtaining letsencrypt certificates, needs only be changed if this is a public facing server
+#TRAEFIK_ACME_MAIL=
+
+### ocis settings ###
+# ocis version, defaults to latest
+#OCIS_DOCKER_TAG=
+# domain of ocis, where you can find ocis. defaults to ocis.owncloud.local
+#OCIS_DOMAIN=
+# ocis openid connect client id. defaults to ocis-phoenix
+#OCIS_OIDC_CLIENT_ID=
+
+### keycloak ###
+# domain of keycloak, where you can find keycloak. defaults to keycloak.owncloud.local
+#KEYCLOAK_DOMAIN=
+# realm which to be used with ocis. defaults to master
+#KEYCLOAK_REALM=
+# admin user. defaults to admin
+#KEYCLOAK_ADMIN_USER=
+# admin password. defaults to admin
+#KEYCLOAK_ADMIN_PASSWORD=
\ No newline at end of file
diff --git a/deployments/examples/ocis_keycloak/README.md b/deployments/examples/ocis_keycloak/README.md
new file mode 100644
index 0000000000..178b2c4e7e
--- /dev/null
+++ b/deployments/examples/ocis_keycloak/README.md
@@ -0,0 +1,43 @@
+# ocis with keycloak as identity provider
+
+## set up DNS / hostnames
+
+If you only want to start the example on your local computer, please add following lines to your hosts file (`/etc/hosts):
+
+```
+127.0.0.1 traefik.owncloud.test
+127.0.0.1 ocis.owncloud.test
+127.0.0.1 keycloak.owncloud.test
+```
+
+For a deployment of the example on a internet facing server please set up dns entries pointing to your server.
+
+## configure the deployment example
+
+If you are deploying the example on your local computer, you don't have to change anything in the `.env` file. Please continue with starting the stack.
+
+For a internet facing server you must change at least the domains according to your dns setup:
+- `TRAEFIK_DOMAIN`
+- `OCIS_DOMAIN`
+- `KEYCLOAK_DOMAIN`
+
+In order to receive ssl certificates with letsencrypt change `TRAEFIK_ACME_MAIL` to a valid email address
+
+For security reasons please change credentials
+- `TRAEFIK_BASIC_AUTH_USERS`
+- `KEYCLOAK_ADMIN_USER` and `KEYCLOAK_ADMIN_PASSWORD`
+
+Please also note that there might be default users in ocis, depending on the version you are using.
+
+## starting the stack
+
+just run `docker-compose up`
+
+## set up keycloak
+
+1. go to http://keycloak.owncloud.test (https://KEYCLOAK_DOMAIN) and log in as `admin` (password is `admin`).
+2. go to clients settings and add a client. The client id is `ocis-phoenix` ($OCIS_OIDC_CLIENT_ID). The client protocol is openid-connect. Insert `https://ocis.owncloud.test` (https://OCIS_DOMAIN) as root url. Then save the client.
+3. you can now add users in the users section.
+
+## test ocis
+you now can login with your users configured in keycloak
diff --git a/deployments/examples/ocis_keycloak/docker-compose.yml b/deployments/examples/ocis_keycloak/docker-compose.yml
new file mode 100644
index 0000000000..5a12c95575
--- /dev/null
+++ b/deployments/examples/ocis_keycloak/docker-compose.yml
@@ -0,0 +1,119 @@
+---
+version: "3.4"
+
+services:
+  traefik:
+    image: "traefik:v2.3"
+    networks:
+      default:
+        aliases:
+          - ${OCIS_DOMAIN:-ocis.owncloud.test}
+          - ${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}
+    command:
+      #- "--log.level=DEBUG"
+      - "--certificatesResolvers.http.acme.email=${TRAEFIK_ACME_MAIL:-'example@example.org'}"
+      - "--certificatesResolvers.http.acme.storage=/certs/acme.json"
+      - "--certificatesResolvers.http.acme.httpChallenge.entryPoint=http"
+      - "--api.dashboard=true"
+      - "--entryPoints.http.address=:80"
+      - "--entryPoints.https.address=:443"
+      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
+      - "--providers.docker.exposedByDefault=false"
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "certs:/certs"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.traefik.entrypoints=http"
+      - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN:-traefik.owncloud.test}`)"
+      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS:-admin:$apr1$4vqie50r$YQAmQdtmz5n9rEALhxJ4l.}" # defaults to admin:admin
+      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
+      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
+      - "traefik.http.routers.traefik-secure.entrypoints=https"
+      - "traefik.http.routers.traefik-secure.rule=Host(`${TRAEFIK_DOMAIN:-traefik.owncloud.test}`)"
+      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
+      - "traefik.http.routers.traefik-secure.tls=true"
+      - "traefik.http.routers.traefik-secure.tls.certresolver=http"
+      - "traefik.http.routers.traefik-secure.service=api@internal"
+
+  ocis:
+    image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
+    networks:
+      default:
+    environment:
+      # general config
+      OCIS_DOMAIN: ${OCIS_DOMAIN:-ocis.owncloud.test}
+      #OCIS_LOG_LEVEL: debug
+      # proxy config
+      PROXY_TLS: "false"
+      PROXY_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}/auth/realms/${KEYCLOAK_REALM:-master}
+      PROXY_OIDC_INSECURE: "true"
+      PROXY_AUTOPROVISION_ACCOUNTS: "true"
+      # phoenix config
+      PHOENIX_OIDC_CLIENT_ID: ${OCIS_OIDC_CLIENT_ID:-ocis-phoenix}
+      PHOENIX_OIDC_AUTHORITY: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}/auth/realms/${KEYCLOAK_REALM:-master}
+      PHOENIX_WEB_CONFIG_SERVER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
+      PHOENIX_OIDC_METADATA_URL: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}/auth/realms/${KEYCLOAK_REALM:-master}/.well-known/openid-configuration
+      PHOENIX_WEB_CONFIG_APPS: files,draw-io,markdown-editor,media-viewer
+      # storage config
+      STORAGE_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}
+      STORAGE_DATAGATEWAY_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}/data
+      STORAGE_FRONTEND_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}/
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.ocis.entrypoints=http"
+      - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN:-ocis.owncloud.test}`)"
+      - "traefik.http.middlewares.ocis-https-redirect.redirectscheme.scheme=https"
+      - "traefik.http.routers.ocis.middlewares=ocis-https-redirect"
+      - "traefik.http.routers.ocis-secure.entrypoints=https"
+      - "traefik.http.routers.ocis-secure.rule=Host(`${OCIS_DOMAIN:-ocis.owncloud.test}`)"
+      - "traefik.http.routers.ocis-secure.tls=true"
+      - "traefik.http.routers.ocis-secure.tls.certresolver=http"
+      - "traefik.http.routers.ocis-secure.service=ocis"
+      - "traefik.http.services.ocis.loadbalancer.server.port=9200"
+
+  postgres:
+    image: postgres
+    volumes:
+      - keycloak_postgres_data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: keycloak
+      POSTGRES_USER: keycloak
+      POSTGRES_PASSWORD: password
+
+  keycloak:
+    image: quay.io/keycloak/keycloak:latest
+    environment:
+      DB_VENDOR: POSTGRES
+      DB_ADDR: postgres
+      DB_DATABASE: keycloak
+      DB_USER: keycloak
+      DB_SCHEMA: public
+      DB_PASSWORD: password
+      KEYCLOAK_USER: ${KEYCLOAK_ADMIN_USER:-admin}
+      KEYCLOAK_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
+      PROXY_ADDRESS_FORWARDING: "true"
+    ports:
+      - 8080:8080
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.keycloak.entrypoints=http"
+      - "traefik.http.routers.keycloak.rule=Host(`${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}`)"
+      - "traefik.http.middlewares.keycloak-https-redirect.redirectscheme.scheme=https"
+      - "traefik.http.routers.keycloak.middlewares=keycloak-https-redirect"
+      - "traefik.http.routers.keycloak-secure.entrypoints=https"
+      - "traefik.http.routers.keycloak-secure.rule=Host(`${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}`)"
+      - "traefik.http.routers.keycloak-secure.tls=true"
+      - "traefik.http.routers.keycloak-secure.tls.certresolver=http"
+      - "traefik.http.routers.keycloak-secure.service=keycloak"
+      - "traefik.http.services.keycloak.loadbalancer.server.port=8080"
+      - "traefik.http.services.keycloak.loadbalancer.server.scheme=http"
+    depends_on:
+      - postgres
+
+volumes:
+  certs:
+  keycloak_postgres_data: