From Dogtag
Revision as of 04:26, 12 October 2019 by Edewata (talk | contribs) (Configuring Tomcat Client)

Jump to: navigation, search


To build Keycloak:

$ git clone
$ cd keycloak
$ mvn install

See also:


To install Keycloak server:

$ wget
$ tar xzvf keycloak-6.0.1.tar.gz
$ cd keycloak-6.0.1/bin

To setup admin user:

$ ./ -u admin -p Secret.123

To start Keycloak server:

$ ./ -b=

Adding a New Realm

To access the Admin Console, open http://$HOSTNAME:8080/auth/admin/.

To access a realm, open http://$HOSTNAME:8080/auth/realms/<realm>/account.

Adding Roles in Realm

Adding Users in Realm

Configuring Tomcat Client

To create a Tomcat server:

$ pki-server create tomcat@keycloak
$ pki-server http-connector-mod -i tomcat@keycloak --port 9080 Connector1

To install Keycloak client adapter:

$ curl \
    --output keycloak-tomcat-adapter-dist-7.0.0.tar.gz
$ mkdir lib
$ cd lib
$ tar xzvf ../keycloak-tomcat-adapter-dist-7.0.0.tar.gz
$ mv * /var/lib/tomcats/keycloak/lib

To enable Keycloak, create <web application>/META-INF/context.xml:

    <Valve className="org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve"/>

To register Tomcat client:

  • Open Keycloak Admin Console
  • Click Clients -> Create

To generate client adapter configuration, click Installation:

  • Format option: Keycloak OIDC JSON

Then store the configuration in <web application>/WEB-INF/keycloak.json:

  "realm": "demo",
  "auth-server-url": "http://$HOSTNAME:8080/auth",
  "ssl-required": "external",
  "resource": "tomcat",
  "public-client": true,
  "confidential-port": 0

To configure web application, edit <web application>/WEB-INF/web.xml:

  • Define security constraints
  • Define login-config with auth-method set to KEYCLOAK

To run Tomcat server:

$ pki-server run tomcat@keycloak

See Also