Question 1

Custom extensions (jar)

Accepted Answer

Keycloak is designed to cover most use-cases without requiring custom code, but we also want it to be customizable. To achieve this Keycloak has a number of Service Provider Interfaces (SPI) for which you can implement your own providers. Custom providers play a key role in Keycloak's architecture. For every major functionality, like the login flow, authentication, authorization, there's a corresponding Service Provider Interface. This approach allows us to plug custom implementations for any of those services, which Keycloak will then use as it were one of its own.

|| Note: A dedicated infrastructure plan subscription or higher is required to access Cloud-IAM custom extension feature.

These providers must be implemented in Java programming language and compiled as .jar file to be then uploaded to your deployment through Cloud-IAM dashboard or Cloud-IAM API. In its simplest form, a custom provider is just a standard jar file containing one or more service implementations.

A common requirement, especially when legacy systems are involved, is to integrate users from those systems into your Keycloak deployment.

# upload "example.jar" custom extension
curl --location --request POST 'https://api.cloud-iam.com/deployments/$DEPLOYMENT_ID/extensions/jars' \
--header 'Authorization: Bearer $ACCESS_TOKEN' \
--form 'extension=@example.jar' \
--http1.1

Troubleshooting

502 Bad Gateway

If an uploaded custom extension throw an uncaught exception (e.g. Null Point

Question 2

API Authentication

Accepted Answer

| Cloud-IAM API access is only available for dedicated deployments (starting with Roaring Rabbit plan). | Full Keycloak REST API access is available to most of Cloud-IAM subscriptions.

Cloud-IAM API is the best way to automate everything. From deployments lifecycle management to keycloak extension uploads!

In order to authenticate against Cloud-IAM API, first contact our support to receive a dedicated CLIENTID and CLIENTSECRET then authenticate against Cloud-IAM REST API using your own account credentials or a dedicated Cloud-IAM account in your organization (ACCOUNTEMAIL and ACCOUNTPASSWORD) is as follow:

|| Curl and jq are required to run the example below

# retrieve a short-lived (expires after 2 minutes) access token
ACCESS_TOKEN=$(curl -s -q https://iam.cloud-iam.com/auth/realms/cloud-iam/protocol/openid-connect/token -d "grant_type=password&client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}&username=${ACCOUNT_EMAIL}&password=${ACCOUNT_PASSWORD}" | jq -r .access_token)

Question 3

Custom Domains

Accepted Answer

|| Note: You must have a Dedicated infrastructure plan subscription or higher to access the Custom domain feature.

Domain customization allows you to use your domain instead of redirecting your consumers to the Cloud-IAM domain. It will help you maintain consistency and give a frictionless experience to your consumers.

In this article, we will assume that the domain my-custom.domain.tld will serve requests from the deployment deployment.cloud-iam.com.

Custom domain

A CNAME entry must be created in the customer DNS registar with name my-custom.domain.tld that targets deployment.cloud-iam.com

In the end-user point of view my-custom.domain.tld becomes an alias of deployment.cloud-iam.com.

The requests still go straight from the user's browser to the Cloud-IAM deployment without any additional server in the middle. Please note that the JWT token issuer (claim iss) will reflect your custom domain.

Cloud-IAM takes the responsibility of generating a valid TLS certificate for my-custom.domain.tld.

The requests are TLS encrypted end-to-end.

Please contact our support with the full domain name you wish to have, our awesome support will tell you where to point your CNAME.

How to setup a reverse-proxy
[How to setup a CDN](/en/article/use

Question 4

Personalize Your Login Interface and Branding (custom theme)

Accepted Answer

The whole authentication and registration experience along with the email sent can be customized in Keycloak through a custom extension. Examples are available on official keycloak source base or on our github.

Getting started

Let me help you step by step:

👥 First clone this example repository
Then edit the names in ./pom.xml to match your company (these lines)
Rename the directory cloud-iam-redesign in src/main/resources/theme/ with the same name you will put line 3 in src/main/resources/META-INF/keycloak-themes.json (this line)
put inside src/main/resources/theme/{YOUR_DIRECTORY_NAME}/login your theme files — or update the files to match your theme —. Be sure to check that you have a themes.properties file (like this one) in src/main/resources/theme/{YOUR_DIRECTORY_NAME}/login/theme.properties
⏩ run ./build.sh command in the root folder (same folder as pom.xml). If you don't have mave

Question 5

Environment variables

Accepted Answer

Cloud IAM dashboard and API can now be used to define environment variables that will be injected in your Keycloak deployment’s environment.

Any uploaded custom Keycloak extensions can access these environment variables for configuration purposes.

Every time environment variables are changed, Cloud-IAM will trigger a zero-downtime redeployment of the corresponding Keycloak cluster.

Example of environment variables

Question 6

Keycloak logs

Accepted Answer

What would be a managed service without real-time logs? Cloud-IAM dashboard displays real-time logs for every dedicated deployments (starting from Roaring Rabbit plan).

Logs access are the best way to understand what is going on with your deployment and how your custom extensions are doing.

Keycloak real-time logs

Frequently Read Articles

Browse All Categories