Identity and Authorization

These guides walk platform engineers through common identity and authorization tasks in UDS Core. Each guide covers a single goal with step-by-step instructions.

For background on how Keycloak, Authservice, and SSO work together, see Identity & Authorization concepts.

Guides

Manage Keycloak admin accessBootstrap a temporary Keycloak admin user, then remove it when the work is complete.

Register and customize SSO clientsRegister native OIDC or SAML clients, customize secrets, add protocol mappers, and configure client attributes.

Protect non-OIDC apps with SSOAdd SSO protection to applications that have no native OIDC support.

Enforce group-based access controlsRestrict application access to users in specific Keycloak groups using the `Package` CR.

Configure service account clientsSet up machine-to-machine authentication using the OAuth 2.0 Client Credentials Grant.

Configure OAuth 2.0 device flowEnable device authorization for CLI tools and headless apps that cannot use a browser redirect.

Configure Keycloak authentication methodsEnable or disable username/password, X.509/CAC, WebAuthn, OTP, and social login via bundle overrides.

Configure Keycloak login policiesSet session timeouts, concurrent session limits, and logout behavior via bundle overrides.

Configure Keycloak account lockoutSet temporary and permanent lockout thresholds for brute-force protection.

Configure automatic account inactivity disableAutomatically disable non-admin accounts after a set number of days of inactivity to satisfy APSC-DV-000320.

Configure user accounts and security policiesSet password complexity, enable email verification, and extend security hardening allow lists via bundle overrides.

Customize Keycloak login page brandingReplace the default logos, background, and Terms & Conditions content via bundle overrides and ConfigMaps.

Configure Keycloak HTTP retriesEnable and tune retry behavior for Keycloak outbound HTTP requests to external services.

Configure Keycloak notifications and alertsEnable Prometheus alerting rules so Keycloak realm, user, and admin changes trigger Alertmanager notifications.

Connect Azure AD as an identity providerConfigure Azure Entra ID as a SAML IdP so users authenticate via Azure instead of local Keycloak accounts.

Configure Google SAML as an identity providerConnect Google SAML using realmInitEnv bundle overrides, with no admin UI required.

Configure the CA truststoreReplace the default DoD CA bundle with a custom certificate authority for X.509/CAC authentication.

Configure CRL-based certificate revocation in an airgapLoad CRL files into Keycloak via an OCI data image so X.509/CAC revocation checks work without OCSP access.

Build a custom Keycloak configuration imageBuild, publish, and deploy a custom configuration image to UDS Core for theme or truststore changes.

Upgrade to FIPS 140-2 modeMigrate an existing non-FIPS deployment to FIPS 140-2 Strict Mode before upgrading UDS Core.

Manage Keycloak with OpenTofuEnable the built-in OpenTofu client and use it to programmatically manage Keycloak resources.