Red Hat Build of Keycloak

https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6
Admin
Red Hat Build of Keycloak is an open-source identity and access management solution that provides...
Tokens:606,930
Snippets:9,585
Trust Score:10
Update:3 months ago
Show doc for...
Tokens:
Raw
### Start server with optimized flag

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_configuration_guide/configuration-

Starts the server using the pre-built optimized configuration.

```bash
bin/kc.[sh|bat] start --optimized <configuration-options>
```

--------------------------------

### Install and Configure Express Middleware

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html-single/securing_applications_and_services_guide/jwt-authorization-grant

Setup Express and integrate the Keycloak middleware.

```bash
    npm install express
```

```javascript
    const express = require('express');
    const app = express();
```

```javascript
    app.use( keycloak.middleware() );
```

```javascript
    app.listen(3000, function () {
        console.log('App listening on port 3000');
    });
```

--------------------------------

### Building and Starting the Server

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_configuration_guide/db-

Commands to create an optimized server image and start the server using the configuration file.

```bash
bin/kc.[sh|bat] build
bin/kc.[sh|bat] start --optimized
```

--------------------------------

### Configure package.json Start Script

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/securing_applications_and_services_guide/nodejs-adapter-

Adds the start script to the package.json file to run the server.

```json
    "scripts": {
        "test": "echo \"Error: no test specified\" && exit 1",
        "start": "node server.js"
    },
```

--------------------------------

### SPI Configuration Examples

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/migration_guide/migrating-server

Examples of setting SPI provider properties using CLI, environment variables, and configuration files.

```bash
./kc.sh start --spi-connections-http-client—default—connection-pool-size 10
```

```bash
KC_SPI_CONNECTIONS_HTTP_CLIENT _DEFAULT_ CONNECTION_POOL_SIZE=10
```

```text
spi-connections-http-client—default—connection-pool-size=10
```

```text
kc.spi-connections-http-client—default—connection-pool-size=10
```

--------------------------------

### Install Service with User Credentials

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html-single/server_configuration_guide/configuration~

Install the service to run as a specific user, optionally using an environment variable for the password.

```batch
bin\kc.bat tools windows-service install --service-user="DOMAIN\Username" --service-password="password"
```

```batch
set KC_SERVICE_PASSWORD=s3cret
bin\kc.bat tools windows-service install --service-user="DOMAIN\Username"
```

--------------------------------

### Start server in development mode

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/migration_guide/migrating-server

Use this command to start the server for development purposes without requiring additional configuration properties. This mode is not suitable for production environments.

```bash
./kc.sh start-dev
```

```bash
./standalone.sh
```

--------------------------------

### Run the Server

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/securing_applications_and_services_guide/nodejs-adapter-

Command to start the Node.js application.

```bash
    npm run start
```

--------------------------------

### Starting the Server with Command-Line Arguments

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_configuration_guide/db-

Directly configuring database parameters during server startup without using the configuration file.

```bash
bin/kc.[sh|bat] start --db postgres --db-url-host keycloak-postgres --db-username keycloak --db-password change_me
```

--------------------------------

### GET /health/live

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/observability_guide/health-

Check if Red Hat build of Keycloak is running. If this fails the application should be discarded and started again.

```APIDOC
## GET /health/live

### Description
Check if Red Hat build of Keycloak is running. If this fails the application should be discarded (terminated, shutdown) and started again.

### Method
GET

### Endpoint
/health/live

### Response
#### Success Response (200)
- **status** (string) - The overall status of the check (e.g., UP).
- **checks** (array) - A list of individual health check results.

#### Error Response (503)
- **status** (string) - The overall status of the check (e.g., DOWN).
```

--------------------------------

### Configure migration timeout

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/upgrading_guide/upgrading

Adjust the transaction setup timeout for database migrations using the start command.

```bash
kc.[sh|bat] start --transaction-setup-timeout=60m
```

--------------------------------

### Install Dependencies and Scripts

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html-single/securing_applications_and_services_guide/jwt-authorization-grant

Commands and configuration for setting up the project environment.

```bash
    npm install express-session
```

```json
    "scripts": {
        "test": "echo \"Error: no test specified\" && exit 1",
        "start": "node server.js"
    },
```

```bash
    npm run start
```

--------------------------------

### Install Dependencies

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html-single/securing_applications_and_services_guide/policy-enforcer-

Commands to install required npm packages for the application.

```bash
    npm install express-session
```

```bash
    npm install express
```

--------------------------------

### init(options)

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/securing_applications_and_services_guide/javascript-adapter-

Initializes the Keycloak adapter with the provided configuration options.

```APIDOC
## init(options)

### Description
Initializes the adapter. This method must be called to configure the adapter behavior, including authentication flow, token management, and session monitoring.

### Parameters
- **options** (Object) - Required - Configuration object containing the following properties:
  - **useNonce** (boolean) - Optional - Adds a cryptographic nonce to verify the authentication response (default: true).
  - **onLoad** (string) - Optional - Specifies an action to do on load. Supported values: 'login-required', 'check-sso'.
  - **redirectUri** (string) - Optional - Default URI to redirect to after login or logout.
  - **silentCheckSsoRedirectUri** (string) - Optional - Redirect URI for silent authentication check.
  - **silentCheckSsoFallback** (boolean) - Optional - Enables fallback to regular check-sso (default: true).
  - **token** (string) - Optional - Initial value for the token.
  - **refreshToken** (string) - Optional - Initial value for the refresh token.
  - **idToken** (string) - Optional - Initial value for the id token.
  - **scope** (string) - Optional - Space-delimited list of scopes.
  - **timeSkew** (number) - Optional - Skew between local time and server in seconds.
  - **checkLoginIframe** (boolean) - Optional - Enable/disable monitoring login state (default: true).
  - **checkLoginIframeInterval** (number) - Optional - Interval to check login state in seconds (default: 5).
  - **responseMode** (string) - Optional - OpenID Connect response mode ('query' or 'fragment', default: 'fragment').
  - **flow** (string) - Optional - OpenID Connect flow ('standard', 'implicit', or 'hybrid').
  - **enableLogging** (boolean) - Optional - Enables console logging (default: false).
  - **pkceMethod** (string|boolean) - Optional - PKCE method ('S256' or false).
  - **messageReceiveTimeout** (number) - Optional - Timeout in milliseconds for message responses (default: 10000).
  - **locale** (string) - Optional - Sets the 'ui_locales' query param.
```

--------------------------------

### Install cert-manager

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/high_availability_guide/single-cluster-introduction-

Installs cert-manager required for the Barman Cloud plugin.

```bash
oc apply --filename=https://github.com/cert-manager/cert-manager/releases/download/v1.20.0/cert-manager.yaml
```

--------------------------------

### Access CLI Help

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/securing_applications_and_services_guide/client-registration-cli-

Display built-in help documentation for the Client Registration CLI.

```bash
$ kcreg.sh help
```

```batch
c:\> kcreg help
```

--------------------------------

### Install Express dependency

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/securing_applications_and_services_guide/nodejs-adapter-

Command to install the Express framework via npm.

```bash
    npm install express
```

--------------------------------

### Install express-session Dependency

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/securing_applications_and_services_guide/nodejs-adapter-

Command to install the required session management dependency.

```bash
    npm install express-session
```

--------------------------------

### Run Provisioning Script

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_administration_guide/user-storage-federation

Execute the federation setup script to configure SSSD and PAM.

```bash
$ bin/federation-sssd-setup.sh
```

--------------------------------

### Install SSSD D-Bus

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_administration_guide/user-storage-federation

Install the required sssd-dbus RPM package on the host system.

```bash
$ sudo yum install sssd-dbus
```

--------------------------------

### Configure SPI via CLI

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_developer_guide/user-storage-spi

Example command to pass configuration arguments to the server at startup.

```bash
kc.[sh|bat] start --spi-storage--readonly-property-file--path=/other-users.properties
```

--------------------------------

### Compare Server Startup Commands

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html-single/migration_guide/index

Comparison of startup commands between Red Hat build of Keycloak and Red Hat Single Sign-On 7.6.

```bash
./kc.sh start --cache=local
```

```bash
./standalone.sh
```

```bash
./kc.sh start [--cache=ispn]
```

```bash
./standalone.sh --server-config=standalone-ha.xml
```

--------------------------------

### Install Keycloak as a Windows service

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_configuration_guide/windows-service-

Various commands to install the Keycloak service with different configurations.

```batch
bin\kc.bat tools windows-service install --name keycloak
```

```batch
bin\kc.bat tools windows-service install --startup=manual --stop-timeout=60
```

```batch
bin\kc.bat tools windows-service install --startup=delayed
```

```batch
bin\kc.bat tools windows-service install --name=my-keycloak --display-name="My Keycloak Server"
```

```batch
bin\kc.bat tools windows-service install --depends-on="postgresql-x64-15;Tcpip;Afd"
```

```batch
bin\kc.bat tools windows-service install --service-user="DOMAIN\Username" --service-password="password"
```

```batch
set KC_SERVICE_PASSWORD=s3cret
bin\kc.bat tools windows-service install --service-user="DOMAIN\Username"
```

--------------------------------

### Verify IPA Installation

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_administration_guide/user-storage-federation

Command to verify the IPA client installation by authenticating as the admin user.

```bash
 kinit admin
```

--------------------------------

### Configure and use Initial Access Token on Linux

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html-single/securing_applications_and_services_guide/policy-enforcer-

Commands to set an initial access token and create a client on Linux systems.

```bash
$ kcreg.sh config initial-token $TOKEN
$ kcreg.sh create -s clientId=myclient
```

```bash
$ kcreg.sh create -s clientId=myclient -t $TOKEN
```

--------------------------------

### Install Keycloak JavaScript library

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/authorization_services_guide/enforcer_overview

Use NPM to install the required Keycloak JavaScript library.

```bash
npm install keycloak-js
```

--------------------------------

### Start server with optimized parameter

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_configuration_guide/configuration-

Final command to start the server after performing an optimized build.

```bash
bin/kc.[sh|bat] start --optimized
```

--------------------------------

### Configure runtime settings

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_configuration_guide/configuration-

Example configuration file content for database and host settings.

```properties
db-url-host=keycloak-postgres
db-username=keycloak
db-password=change_me
hostname=mykeycloak.acme.com
https-certificate-file
```

--------------------------------

### Configure and use Initial Access Token on Windows

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html-single/securing_applications_and_services_guide/policy-enforcer-

Commands to set an initial access token and create a client on Windows systems.

```batch
c:\> kcreg config initial-token %TOKEN%
c:\> kcreg create -s clientId=myclient
```

```batch
c:\> kcreg create -s clientId=myclient -t %TOKEN%
```

--------------------------------

### Configure and use Initial Access Token

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/securing_applications_and_services_guide/client-registration-cli-

Commands to set an initial access token and create a client on Linux or Windows.

```bash
$ kcreg.sh config initial-token $TOKEN
$ kcreg.sh create -s clientId=myclient
```

```bash
$ kcreg.sh create -s clientId=myclient -t $TOKEN
```

```batch
c:\> kcreg config initial-token %TOKEN%
c:\> kcreg create -s clientId=myclient
```

```batch
c:\> kcreg create -s clientId=myclient -t %TOKEN%
```

--------------------------------

### Audience Claim Example

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_administration_guide/assembly-managing-clients_server_administration_guide

Example of an 'aud' claim in a token, restricting its usage to a specific service.

```json
"aud": "service1"
```

--------------------------------

### CLI configuration equivalent

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/migration_guide/migrating-operator

Demonstrates how the Keycloak CR configuration maps to the standard Keycloak CLI startup arguments.

```bash
./kc.sh start --db=postgres --db-url-host=postgres-db --db-username=user --db-password=pass --https-certificate-file=mycertfile --https-certificate-key-file=myprivatekey --hostname=test.keycloak.org --spi-connections-http-client--default--connection-pool-size=20
```

--------------------------------

### Example SPI Configuration Property

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_configuration_guide/configuration-provider-

An example of setting the connection-pool-size property for the default HttpClientSpi provider.

```text
spi-connections-http-client--default--connection-pool-size=10
```

--------------------------------

### Display help for configuration parameters

Source: https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.6/html/server_configuration_guide/configuration-

Command to list all available configuration options and their formats.

```bash
bin/kc.[sh|bat] start --help
```
Tokens:
Raw