Question 1

Configure Keycloak remote JWKS support

Accepted Answer

The JSON Web Key Set (JWKS) is a set of keys containing the public keys used to verify any JSON Web Token (JWT) issued by the authorization server and signed using the RS256 signing algorithm.

When building applications and APIs in Cloud-IAM's keycloak deployments, four algorithms are supported for signing JWTs: RS256, RS384, RS512 and HS256. RS256 generates an asymmetric signature, which means that a private key must be used to sign the JWT and a different public key must be used to verify the signature.

Keycloak uses the JSON Web Key (JWK) specification to represent the cryptographic keys used to sign RS256 tokens. This specification defines two high-level data structures: JSON Web Key (JWK) and JSON Web Key Set (JWKS, a set of JSON Web Key per RFC 7517).

To configure remote JKWS to a client application, first activate JWKS authentication for client application from Keycloak console:

Credentials

Then configure the JWKS url of the application or a certificate directly (URL is recommended to automate certificate rollover).

Keys

Regarding the application configuration, set up Keycloak JWKS url from the .well-known endpoint that is available in the main realm setting page:

![realm settings](https://storage.crisp.chat/users/he

Question 2

How to do multi-tenant with Keycloak

Accepted Answer

When people want to achieve multi tenancy on Keycloak, they often have 2 main ways :

1 realm per tenant

The simple and obvious way. You get proper isolation with different realms, each one having potentially different login page/theme for branding for example. But it comes with some drawbacks that need to be known going down that path.

Pros

Easy to reason about

Cons

Make sure that the usecase does not imply that the same user can not access different realms at the same time. Because even if it is the same account (same email for example), it would be 2 different identities for Keycloak, having different lifecycle (it can even lead to different password for exemple, depending on the feature you activate). This kind of setup would need to setup Identity Providers between the different realms, resulting in frictions in the user experience. By default when you setup an Identity Provider (IdP), you ask the user to choose how he want to connect : on this realm, I use my login/password, on that one I sign in with my other realm account, etc. This behavior can be dealed with custom extensions in order to keep the friction low on the UX.
High numbers of realm leads to performance drops in Keycloak when you hit several hundred of realms, because of the technical choice done by the Red Hat teams. Even if things are going better with the new versions of Keycloak, it is still not perfect.

1 client per tenant (in 1 r

Question 3

Custom extensions (jar)

Accepted Answer

Keycloak is designed to cover most use-cases without requiring custom code, but we also want it to be customizable. To achieve this Keycloak has a number of Service Provider Interfaces (SPI) for which you can implement your own providers. Custom providers play a key role in Keycloak's architecture. For every major functionality, like the login flow, authentication, authorization, there's a corresponding Service Provider Interface. This approach allows us to plug custom implementations for any of those services, which Keycloak will then use as it were one of its own.

|| Note: A dedicated infrastructure plan subscription or higher is required to access Cloud-IAM custom extension feature.

These providers must be implemented in Java programming language and compiled as .jar file to be then uploaded to your deployment through Cloud-IAM dashboard or Cloud-IAM API. In its simplest form, a custom provider is just a standard jar file containing one or more service implementations.

A common requirement, especially when legacy systems are involved, is to integrate users from those systems into your Keycloak deployment.

# upload "example.jar" custom extension
curl --location --request POST 'https://api.cloud-iam.com/deployments/$DEPLOYMENT_ID/extensions/jars' \
--header 'Authorization: Bearer $ACCESS_TOKEN' \
--form 'extension=@example.jar' \
--http1.1

Troubleshooting

502 Bad Gateway

If an uploaded custom extension throw an uncaught exception (e.g. Null Point

Question 4

Personalize Your Login Interface and Branding (custom theme)

Accepted Answer

The whole authentication and registration experience along with the email sent can be customized in Keycloak through a custom extension. Examples are available on official keycloak source base or on our github.

Getting started

Let me help you step by step:

👥 First clone this example repository
Then edit the names in ./pom.xml to match your company (these lines)
Rename the directory cloud-iam-redesign in src/main/resources/theme/ with the same name you will put line 3 in src/main/resources/META-INF/keycloak-themes.json (this line)
put inside src/main/resources/theme/{YOUR_DIRECTORY_NAME}/login your theme files — or update the files to match your theme —. Be sure to check that you have a themes.properties file (like this one) in src/main/resources/theme/{YOUR_DIRECTORY_NAME}/login/theme.properties
⏩ run ./build.sh command in the root folder (same folder as pom.xml). If you don't have mave

Question 5

API Authentication

Accepted Answer

| Cloud-IAM API access is only available for dedicated deployments (starting with Roaring Rabbit plan). | Full Keycloak REST API access is available to most of Cloud-IAM subscriptions.

Cloud-IAM API is the best way to automate everything. From deployments lifecycle management to keycloak extension uploads!

In order to authenticate against Cloud-IAM API, first contact our support to receive a dedicated CLIENTID and CLIENTSECRET then authenticate against Cloud-IAM REST API using the provided service account credentials in your organization as follow (please provide a GPG key):

|| Curl and jq are required to run the example below

# retrieve a short-lived (expires after 2 minutes) access token
ACCESS_TOKEN=$(curl -s -q https://iam.cloud-iam.com/auth/realms/cloud-iam/protocol/openid-connect/token -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=client_credentials&client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}" | jq -r .access_token)

Back to the website

Question 6

Keycloak /metrics endpoint

Accepted Answer

| In order for Cloud-IAM to monitor any new realm metrics it must be configured accordingly

Cloud-IAM REST API /deployments/{deployment_id}/metrics endpoint yield functional metrics about your Keycloak in OpenMetrics format textual representation that came from Prometheus textual representation.

It yields counters regarding various parts of your Keycloak deployment.

|| Counters measure discrete events. Common examples are the number of HTTP requests received, CPU seconds spent, or bytes sent. For counters how quickly they are increasing over time is what is of interest to a user.

A response from the /deployments/{deployment_id}/metrics endpoint will yield a line (called a MetricPoint) like this one:

keycloak_login_attempts{application="keycloak",client_id="account-console",realm="master"} 2 1645446218620

For each MetricPoint:

A MetricPoint in a Metric with the type Counter MUST have one value called Total (2 in the line example). A Total is a non-NaN and MUST be monotonically non-decreasing over time, starting from 0.
A MetricPoint in a Metric with the type Counter SHOULD have a Timestamp (1645446218620 from the line example) value called Created. This can help ingestors discern between new metrics and long-running ones it did not see before.
A MetricPoint in a Metric's Counter's Total MAY reset to 0. If present, the corresponding Created time MUST also be

Frequently Read Articles

Browse All Categories