Keycloak

Keycloak is an open-source identity and access management solution.

Key features:

• SSO (Single Sign-On)
• Identity brokering
• User federation
• Fine-grained authorization

shc install keycloak --stack iam

Common variables:

• admin_user - Admin username (default: admin)
• admin_password - Admin password (auto-generated)
• public_host - Public hostname
• db_vendor - Database type (default: postgres)

Keycloak integrates with PostgreSQL via plug/socket:

shc install postgres --stack db
shc install keycloak --stack iam  # Auto-wires to postgres

Access admin console:

• URL: https://{public_host}/admin
• Username: {admin_user}
• Password: (from vault) shc vault get keycloak/admin_password

Keycloak backups include:

• Realm configurations
• User data (via PostgreSQL)
• Themes and customizations

Use converters for realm export:

shc backup create --stack iam

Create additional realms as VApps:

shc install keycloak-realm --parent-stack iam --instance my-realm \
  --var realm_name=my-realm --var realm_display_name="My Realm"

Common issues:

Problem: Admin console not accessible Solution: Check public_host configuration and Traefik labels

Problem: Database connection failed Solution: Verify PostgreSQL socket integration

• PostgreSQL
• App Commands