keycloak-documentation
Introduction
1.
Getting Started
1.1.
Overview
1.2.
Installing and Booting
1.2.1.
Installing the Server
1.2.2.
Booting the Server
1.2.3.
Creating the Admin Account
1.2.4.
Logging in to the Admin Console
1.3.
Creating Your First Realm and User
1.3.1.
Before You Start
1.3.2.
Creating a New Realm
1.3.3.
Creating a New User
1.3.4.
User Account Service
1.4.
Securing a JBoss Servlet Application
1.4.1.
Before You Start
1.4.2.
Installing the Client Adapter
1.4.3.
Downloading, Building, and Deploying Application Code
1.4.4.
Creating and Registering the Client
1.4.5.
Configuring the Subsystem
2.
Server Installation and Configuration
2.1.
Overview
2.1.1.
Recommended Reading
2.2.
Installation
2.2.1.
System Requirements
2.2.2.
Installing Distribution Files
2.2.3.
Distribution Directory Structure
2.3.
Choosing an Operating Mode
2.3.1.
Standalone Mode
2.3.2.
Standalone Clustered Mode
2.3.3.
Domain Clustered Mode
2.4.
Managing Configuration
2.4.1.
Configure SPI Providers
2.4.2.
Start CLI
2.4.3.
CLI Recipes
2.5.
Profiles
2.6.
Relational Database Setup
2.6.1.
Setup Checklist
2.6.2.
JDBC Setup
2.6.3.
Datasource Setup
2.6.4.
Database Configuration
2.6.5.
Unicode Considerations
2.7.
Network Setup
2.7.1.
Bind Addresses
2.7.2.
Socket Port Bindings
2.7.3.
HTTPS/SSL Setup
2.7.4.
Outgoing HTTP Requests
2.8.
Clustering
2.8.1.
Recommended Network Architecture
2.8.2.
Cluster Example
2.8.3.
Setting Up a Load Balancer or Proxy
2.8.4.
Sticky Sessions Support
2.8.5.
Multicast Network Setup
2.8.6.
Securing Cluster Communication
2.8.7.
Serialized Cluster Startup
2.8.8.
Booting the Cluster
2.8.9.
Troubleshooting
2.9.
Server Cache Configuration
2.9.1.
Eviction Policy and Max Entries
2.9.2.
Replication and Failover
2.9.3.
Disabling Caching
2.9.4.
Clearing Caches at Runtime
2.10.
Keycloak Security Proxy
3.
Server Administration
3.1.
Overview
3.1.1.
Features
3.1.2.
How Does Security Work?
3.1.3.
Core Concepts and Terms
3.2.
Server Initialization
3.3.
Admin Console
3.3.1.
The Master Realm
3.3.2.
Creating a New Realm
3.3.3.
Realm SSL Mode
3.3.4.
Clearing Server Caches
3.3.5.
Email Settings
3.3.6.
Themes and Internationalization
3.4.
User Management
3.4.1.
Viewing Users
3.4.2.
Creating New Users
3.4.3.
User Attributes
3.4.4.
Credentials
3.4.5.
Required Actions
3.4.6.
Impersonation
3.4.7.
User Registration
3.4.7.1.
Recaptcha Support
3.5.
Login Page Settings
3.5.1.
Forgot Password
3.5.2.
Remember Me
3.6.
Authentication
3.6.1.
Password Policies
3.6.2.
OTP Policies
3.6.3.
Authentication Flows
3.6.4.
Kerberos
3.6.5.
X509 Client Certificate Authentication
3.7.
SSO Protocols
3.7.1.
OpenID Connect
3.7.2.
SAML
3.7.3.
OIDC vs. SAML
3.7.4.
Docker
3.8.
Managing Clients
3.8.1.
OIDC Clients
3.8.1.1.
Confidential Client Credentials
3.8.1.2.
Service Accounts
3.8.2.
SAML Clients
3.8.2.1.
IDP Initiated Login
3.8.2.2.
SAML Entity Descriptors
3.8.3.
Client Links
3.8.4.
Token and Assertion Mappings
3.8.5.
Generating Client Adapter Config
3.8.6.
Client Templates
3.9.
Roles
3.9.1.
Realm Roles
3.9.2.
Client Roles
3.9.3.
Composite Roles
3.9.4.
User Role Mappings
3.9.4.1.
Default Roles
3.9.5.
Client Scope
3.10.
Groups
3.10.1.
Groups Vs. Roles
3.10.2.
Default Groups
3.11.
Admin Console Access Control and Permissions
3.11.1.
Master Realm
3.11.2.
Dedicated Realm Admin Consoles
3.12.
Realm Keys
3.13.
Identity Brokering
3.13.1.
Brokering Overview
3.13.2.
Default Provider
3.13.3.
General Configuration
3.13.4.
Social Login
3.13.4.1.
Google
3.13.4.2.
Facebook
3.13.4.3.
Twitter
3.13.4.4.
Github
3.13.4.5.
Linked-In
3.13.4.6.
Microsoft
3.13.4.7.
Stack Overflow
3.13.4.8.
Openshift
3.13.5.
OIDC Providers
3.13.6.
SAML Providers
3.13.7.
Client Suggested Identity Provider
3.13.8.
Mapping Claims and Assertions
3.13.9.
Available User Session Data
3.13.10.
First Login Flow
3.13.11.
Retrieving External IDP Tokens
3.14.
User Session Management
3.14.1.
Administering Sessions
3.14.2.
Revocation Policies
3.14.3.
Session and Token Timeouts
3.14.4.
Offline Access
3.15.
User Storage Federation
3.15.1.
LDAP/AD Integration
3.15.2.
SSSD and FreeIPA/IdM Integration
3.15.3.
Custom Providers
3.16.
Auditing and Events
3.16.1.
Login Events
3.16.2.
Admin Events
3.17.
Export and Import
3.18.
User Account Service
3.19.
Threat Model Mitigation
3.19.1.
Password Guess, Brute Force Attacks
3.19.2.
Clickjacking
3.19.3.
SSL/HTTPS Requirement
3.19.4.
CSRF
3.19.5.
Unspecific Redirect URIs
3.19.6.
Compromised Access and Refresh tokens
3.19.7.
Compromised Access Codes
3.19.8.
Open Redirectors
3.19.9.
Password database compromised
3.19.10.
Limiting Scope
3.19.11.
SQL Injection Attacks
3.20.
Admin CLI
3.21.
Migration from older versions
4.
Securing Applications and Services
4.1.
Overview
4.1.1.
What are Client Adapters?
4.1.2.
Supported Platforms
4.1.3.
Supported Protocols
4.2.
OpenID Connect
4.2.1.
Java Adapters
4.2.1.1.
Java Adapters Config
4.2.1.2.
JBoss EAP/Wildfly Adapter
4.2.1.3.
JBoss Fuse Adapter
4.2.1.3.1.
Install Feature
4.2.1.3.2.
Classic WAR application
4.2.1.3.3.
Servlet Deployed as OSGI Service
4.2.1.3.4.
Apache Camel
4.2.1.3.5.
Apache CXF on Separate Jetty
4.2.1.3.6.
Apache CXF on default Jetty
4.2.1.3.7.
Fuse Admin Services
4.2.1.3.8.
Hawtio Admin Console
4.2.1.4.
Tomcat 6, 7 and 8 Adapters
4.2.1.5.
Jetty 9.x Adapters
4.2.1.6.
Jetty 8.1.x Adapter
4.2.1.7.
Spring Boot Adapter
4.2.1.8.
Spring Security Adapter
4.2.1.9.
Java Servlet Filter Adapter
4.2.1.10.
JAAS plugin
4.2.1.11.
Security Context
4.2.1.12.
Error Handling
4.2.1.13.
Logout
4.2.1.14.
Parameters Forwarding
4.2.1.15.
Client Authentication
4.2.1.16.
Multi Tenancy
4.2.1.17.
Application Clustering
4.2.2.
JavaScript Adapter
4.2.3.
Node.js Adapter
4.2.4.
Other OpenID Connect libraries
4.2.4.1.
mod_auth_oidc Apache HTTPD Module
4.3.
SAML
4.3.1.
Java Adapters
4.3.1.1.
General Adapter Config
4.3.1.1.1.
SP Element
4.3.1.1.2.
SP Keys and Key elements
4.3.1.1.3.
SP PrincipalNameMapping element
4.3.1.1.4.
RoleIdentifiers element
4.3.1.1.5.
IDP Element
4.3.1.1.6.
IDP SingleSignOnService sub element
4.3.1.1.7.
IDP SingleLogoutService sub element
4.3.1.1.8.
IDP Keys subelement
4.3.1.1.9.
IDP HttpClient subelement
4.3.1.2.
JBoss EAP/Wildfly Adapter
4.3.1.2.1.
Adapter Installation
4.3.1.2.2.
Per WAR Configuration
4.3.1.2.3.
Securing WARs via SAML Subsystem
4.3.1.3.
Tomcat SAML adapters
4.3.1.3.1.
Adapter Installation
4.3.1.3.2.
Per WAR Configuration
4.3.1.4.
Jetty SAML Adapters
4.3.1.4.1.
Jetty 9 Adapter Installation
4.3.1.4.2.
Jetty 9 Per WAR Configuration
4.3.1.4.3.
Jetty 8 Adapter Installation
4.3.1.4.4.
Jetty 8 Per WAR Configuration
4.3.1.5.
Java Servlet Filter Adapter
4.3.1.6.
Registering with an IDP
4.3.1.7.
Logout
4.3.1.8.
Obtaining Assertion Attributes
4.3.1.9.
Error Handling
4.3.1.10.
Troubleshooting
4.3.1.11.
Migration from older versions
4.3.2.
mod_auth_mellon Apache HTTPD Module
4.4.
Docker
4.5.
Client Registration
4.5.1.
Client Registration CLI
5.
Server Development
5.1.
Preface
5.2.
Admin REST API
5.3.
Themes
5.4.
Custom User Attributes
5.5.
Identity Brokering APIs
5.5.1.
Retrieving External IDP Tokens
5.5.2.
Client Initiated Account Linking
5.6.
Service Provider Interfaces (SPI)
5.7.
Extending Server
5.8.
Authentication SPI
5.9.
Event Listener SPI
5.10.
User Storage SPI
5.10.1.
Provider Interfaces
5.10.2.
Provider Capability Interfaces
5.10.3.
Model Interfaces
5.10.4.
Packaging and Deployment
5.10.5.
Simple Read-Only, Lookup Example
5.10.6.
Configuration Techniques
5.10.7.
Add/Remove User and Query Capability interfaces
5.10.8.
Augmenting External Storage
5.10.9.
Import Implementation Strategy
5.10.10.
User Caches
5.10.11.
Leveraging Java EE
5.10.12.
REST Management API
5.10.13.
Migrating from an Earlier User Federation SPI
6.
Authorization Services
6.1.
Overview
6.1.1.
Architecture
6.1.2.
Terminology
6.2.
Getting Started
6.2.1.
Securing a Servlet Application
6.2.1.1.
Creating a Realm and a User
6.2.1.2.
Enabling Authorization Services
6.2.1.3.
Build, Deploy, and Test Your Application
6.2.2.
Examples
6.3.
Managing Resource Servers
6.3.1.
Creating a Client Application
6.3.2.
Enabling Authorization Services
6.3.3.
Default Configuration
6.3.4.
Export and Import Authorization Configuration
6.4.
Managing Resources and Scopes
6.4.1.
Viewing Resources
6.4.2.
Creating Resources
6.5.
Managing Policies
6.5.1.
User-Based Policy
6.5.2.
Role-Based Policy
6.5.2.1.
Defining a Role as Required
6.5.3.
JavaScript-Based Policy
6.5.4.
Rule-Based Policy
6.5.5.
Time-Based Policy
6.5.6.
Aggregated Policy
6.5.7.
Client Policy
6.5.8.
Positive and Negative Logic
6.5.9.
Policy Evaluation API
6.6.
Managing Permissions
6.6.1.
Creating Resource-Based Permissions
6.6.1.1.
Typed Resource Permissions
6.6.2.
Creating Scope-Based Permissions
6.6.3.
Policy Decision Strategies
6.7.
Evaluating and Testing Policies
6.8.
Authorization Services
6.8.1.
Protection API
6.8.1.1.
What is a PAT and How to Obtain It
6.8.1.2.
Managing Resources
6.8.1.3.
Managing Permission Requests
6.8.2.
Authorization API
6.8.2.1.
What is an AAT and How to Obtain It
6.8.2.2.
Requesting Authorization Data and Token
6.8.3.
Entitlement API
6.8.3.1.
Requesting Entitlements
6.8.4.
Introspecting a Requesting Party Token
6.8.5.
Authorization Client Java API
6.9.
Policy Enforcers
6.9.1.
Keycloak Adapter Policy Enforcer
6.9.1.1.
Protecting a Stateless Service Using a Bearer Token
6.9.1.2.
Obtaining the Authorization Context
6.9.1.3.
JavaScript Integration
6.9.1.4.
Setting up TLS/HTTPS
Powered by
GitBook
keycloak-documentation
Server Developer
Keycloak SNAPSHOT
http://www.keycloak.org
