Question 1

Custom extensions (jar)

Accepted Answer

Keycloak is designed to cover most use-cases without requiring custom code, but we also want it to be customizable. To achieve this Keycloak has a number of Service Provider Interfaces (SPI) for which you can implement your own providers. Custom providers play a key role in Keycloak's architecture. For every major functionality, like the login flow, authentication, authorization, there's a corresponding Service Provider Interface. This approach allows us to plug custom implementations for any of those services, which Keycloak will then use as it were one of its own.

|| Note: A dedicated infrastructure plan subscription or higher is required to access Cloud-IAM custom extension feature.

These providers must be implemented in Java programming language and compiled as .jar file to be then uploaded to your deployment through Cloud-IAM dashboard or Cloud-IAM API. In its simplest form, a custom provider is just a standard jar file containing one or more service implementations.

A common requirement, especially when legacy systems are involved, is to integrate users from those systems into your Keycloak deployment.

# upload "example.jar" custom extension
curl --location --request POST 'https://api.cloud-iam.com/deployments/$DEPLOYMENT_ID/extensions/jars' \
--header 'Authorization: Bearer $ACCESS_TOKEN' \
--form 'extension=@example.jar' \
--http1.1

Troubleshooting

502 Bad Gateway

If an uploaded custom extension throw an uncaught exception (e.g. Null Point

Question 2

API Authentication

Accepted Answer

| Cloud-IAM API access is only available for dedicated deployments (starting with Roaring Rabbit plan). | Full Keycloak REST API access is available to most of Cloud-IAM subscriptions.

Cloud-IAM API is the best way to automate everything. From deployments lifecycle management to keycloak extension uploads!

In order to authenticate against Cloud-IAM API, first contact our support to receive a dedicated CLIENTID and CLIENTSECRET then authenticate against Cloud-IAM REST API using the provided service account credentials in your organization as follow:

|| Curl and jq are required to run the example below

# retrieve a short-lived (expires after 2 minutes) access token
ACCESS_TOKEN=$(curl -s -q https://iam.cloud-iam.com/auth/realms/cloud-iam/protocol/openid-connect/token -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=client_credentials&client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}" | jq -r .access_token)

Question 3

Personalize Your Login Interface and Branding (custom theme)

Accepted Answer

The whole authentication and registration experience along with the email sent can be customized in Keycloak through a custom extension. Examples are available on official keycloak source base or on our github.

Getting started

Let me help you step by step:

👥 First clone this example repository
Then edit the names in ./pom.xml to match your company (these lines)
Rename the directory cloud-iam-redesign in src/main/resources/theme/ with the same name you will put line 3 in src/main/resources/META-INF/keycloak-themes.json (this line)
put inside src/main/resources/theme/{YOUR_DIRECTORY_NAME}/login your theme files — or update the files to match your theme —. Be sure to check that you have a themes.properties file (like this one) in src/main/resources/theme/{YOUR_DIRECTORY_NAME}/login/theme.properties
⏩ run ./build.sh command in the root folder (same folder as pom.xml). If you don't have mave

Question 4

Custom Domains

Accepted Answer

|| Note: You must have a Dedicated infrastructure plan subscription or higher to access the Custom domain feature.

Domain customization allows you to use your domain instead of redirecting your consumers to the Cloud-IAM domain. It will help you maintain consistency and give a frictionless experience to your consumers.

In this article, we will assume that the domain my-custom.domain.tld will serve requests from the deployment deployment.cloud-iam.com.

Custom domain

A CNAME entry must be created in the customer DNS registar with name my-custom.domain.tld that targets deployment.cloud-iam.com

|| Note: if you plan to create my-custom.domain.tld and my-custom is a DNS zone of domain.tld, then you'll need to create an ALIAS record instead of a CNAME. The ALIAS record must point to deployment.cloud-iam.com. (be careful to add the trailing .)

In the end-user point of view my-custom.domain.tld becomes an alias of deployment.cloud-iam.com.

The requests still go straight from the user's browser to the Cloud-IAM deployment without any additional server in the middle. Please note that the JWT token issuer (claim iss) will reflect your custom domain.

Cloud-IAM takes the responsibility of generating a valid TLS certificate for my-custom.domain.tld.

The requests are TLS encrypted end-to-end.

Once done, simply declare it through the Cloud-IAM console. This wil

Question 5

Keycloak /metrics endpoint

Accepted Answer

| In order for Cloud-IAM to monitor any new realm metrics it must be configured accordingly

Cloud-IAM REST API /deployments/{deployment_id}/metrics endpoint yield functional metrics about your Keycloak in OpenMetrics format textual representation that came from Prometheus textual representation.

It yields counters regarding various parts of your Keycloak deployment.

|| Counters measure discrete events. Common examples are the number of HTTP requests received, CPU seconds spent, or bytes sent. For counters how quickly they are increasing over time is what is of interest to a user.

A response from the /deployments/{deployment_id}/metrics endpoint will yield a line (called a MetricPoint) like this one:

keycloak_login_attempts{application="keycloak",client_id="account-console",realm="master"} 2 1645446218620

For each MetricPoint:

A MetricPoint in a Metric with the type Counter MUST have one value called Total (2 in the line example). A Total is a non-NaN and MUST be monotonically non-decreasing over time, starting from 0.
A MetricPoint in a Metric with the type Counter SHOULD have a Timestamp (1645446218620 from the line example) value called Created. This can help ingestors discern between new metrics and long-running ones it did not see before.
A MetricPoint in a Metric's Counter's Total MAY reset to 0. If present, the corresponding Created time MUST also be

Question 6

Configure Keycloak remote JWKS support

Accepted Answer

The JSON Web Key Set (JWKS) is a set of keys containing the public keys used to verify any JSON Web Token (JWT) issued by the authorization server and signed using the RS256 signing algorithm.

When building applications and APIs in Cloud-IAM's keycloak deployments, four algorithms are supported for signing JWTs: RS256, RS384, RS512 and HS256. RS256 generates an asymmetric signature, which means that a private key must be used to sign the JWT and a different public key must be used to verify the signature.

Keycloak uses the JSON Web Key (JWK) specification to represent the cryptographic keys used to sign RS256 tokens. This specification defines two high-level data structures: JSON Web Key (JWK) and JSON Web Key Set (JWKS, a set of JSON Web Key per RFC 7517).

To configure remote JKWS to a client application, first activate JWKS authentication for client application from Keycloak console:

Credentials

Then configure the JWKS url of the application or a certificate directly (URL is recommended to automate certificate rollover).

Keys

Regarding the application configuration, set up Keycloak JWKS url from the .well-known endpoint that is available in the main realm setting page:

![realm settings](https://storage.crisp.chat/users/he

Frequently Read Articles

Browse All Categories