Breadcrumbs

Keycloak configuration

Prerequisites

This procedure assumes an existing Keycloak deployment to which you have administrative access. Specifically, you must have permission to create and configure Realms, Clients, Client Scopes, Realm Roles, Users, and Groups on the Keycloak deployment.

Step-by-step procedure

  1. Create a new realm

    image-20240708-115517.png

  2. Set a Display name for the realm and optionally configure the SMTP server (in Email tab) and enable the brute force detection (in Security defenses tab)

    image-20240708-120534.png

  3. Configure an Authentication policy to match your company policy

  4. Create a ‘metavault’ client and specify

    1. Client ID → metavault

    2. Name → metavault

      image-20240708-121157.png

    3. Disable Direct access grants

      image-20240708-121314.png

    4. Root URL → the base URL for the metavault component (example : http://beVault.example.local)

    5. Valid redirect URLs → /*

    6. Web origins → +

      image-20240708-123057.png

  5. Create a ‘states’ client and specify

    1. Client ID → states

    2. Name → States

      image-20240708-121428.png

    3. Disable Direct access grants

      image-20240708-121332.png

    4. Root URL → the base URL for the metavault component (example : http://orchestrator.example.local)

    5. Valid redirect URLs → /*

    6. Web origins → +

      image-20240708-123245.png

  6. Adapt metavault component configuration, see Metavault Configuration

    1. Authority → <keycloak_base_url>/realms/<realm_name> (example: https://keycloak.dfakto.com/realms/bevault)

    2. ClientId → metavault

    3. Audience → account

  7. Adapt states component configuration keys, see States Configuration

    1. Authority → <keycloak_base_url>/realms/<realm_name> (example: https://keycloak.dfakto.com/realms/bevault)

    2. ClientId → states

    3. Audience → account

Go further