keycloak

Keycloak + Coöp Cloud.

• Category: Apps
• Status: 2, beta
• Image: jboss/keycloak, 4, upstream
• Healthcheck: Yes
• Backups: ?
• Email: 1
• Tests: 2
• SSO: N/A

Basic usage

1. Set up Docker Swarm and abra
2. Deploy coop-cloud/traefik
3. abra app new keycloak --secrets (optionally with --pass if you'd like to save secrets in pass). Make sure to note the admin_password which is needed for initial setup.
4. abra app config YOURAPPDOMAIN - be sure to change $DOMAIN to something that resolves to your Docker swarm box
5. abra app deploy YOURAPPDOMAIN

Replacing the temporary admin user

When you first deploy Keycloak, you will login in as a temporary admin user with the username "admin" and a random password generated in step 3 above. You need to create a real admin user and delete the temp admin user, because the temp admin user has no 2FA and its password is stored in plain text on the server, which is insecure. Here's how to create the real admin user:

1. Click "Users" then "Add user"
2. For "required user actions", I recommend setting "Configure OTP" and "Update Password" to ensure 2FA is enabled.
3. Set a username, then click "Create"
4. Go to the "Role Mapping" tab and click "Assign role"
5. Change the filter from "Filter by clients" to "Filter by realm roles". Select the box for "role_admin" and click "Assign". This makes the user become an admin.
6. Go to the "Credentials" tab. Click "Set password". Set it to something random and save it for the next step. Leave "Temporary" enabled so the user has to change the password on first login.
7. If this is an admin account for you, then log out and back in as the new admin user and complete the password change and OTP steps. If this is an admin account for someone else, securely send the initial username and password to the user. They must complete the password change and OTP setup when they first log in.

Once at least one real admin user is set up, you should then delete the temporary "admin" user.

How do I setup a custom theme?

Check this approach.

How do I create another admin user?

• Under the Master realm > Users > Add user
• Create the user and set a temporary password
• Under the Role Mappings tab, move admin from Available Roles into Assigned Roles

What do I do if I lost my admin account credentials?

You can create a new admin account like this:

abra app run <domain> app -- bash -c '/opt/keycloak/bin/kc.sh bootstrap-admin user --db-password $(cat /run/secrets/db_password)'

Make sure to delete the temp-admin user after you finish recovering.

How do I configure Keycloak login for..

• Nextcloud
• Peertube