Identity and Authorization

These guides walk platform engineers through common identity and authorization tasks in UDS Core. Each guide covers a single goal with step-by-step instructions.

For background on how Keycloak, Authservice, and SSO work together, see Identity & Authorization concepts.

Guides

Manage Keycloak admin access Bootstrap a temporary Keycloak admin user, then remove it when the work is complete.

Register and customize SSO clients Register native OIDC or SAML clients, customize secrets, add protocol mappers, and configure client attributes.

Protect non-OIDC apps with SSO Add SSO protection to applications that have no native OIDC support.

Enforce group-based access controls Restrict application access to users in specific Keycloak groups using the `Package` CR.

Configure service account clients Set up machine-to-machine authentication using the OAuth 2.0 Client Credentials Grant.

Configure OAuth 2.0 device flow Enable device authorization for CLI tools and headless apps that cannot use a browser redirect.

Configure Keycloak authentication methods Enable or disable username/password, X.509/CAC, WebAuthn, OTP, and social login via bundle overrides.

Configure Keycloak login policies Set session timeouts, concurrent session limits, and logout behavior via bundle overrides.

Configure Keycloak account lockout Set temporary and permanent lockout thresholds for brute-force protection.

Configure automatic account inactivity disable Automatically disable non-admin accounts after a set number of days of inactivity to satisfy APSC-DV-000320.

Configure user accounts and security policies Set password complexity, enable email verification, and extend security hardening allow lists via bundle overrides.

Customize Keycloak login page branding Replace the default logos, background, and Terms & Conditions content via bundle overrides and ConfigMaps.

Configure Keycloak HTTP retries Enable and tune retry behavior for Keycloak outbound HTTP requests to external services.

Configure Keycloak notifications and alerts Enable Prometheus alerting rules so Keycloak realm, user, and admin changes trigger Alertmanager notifications.

Connect Azure AD as an identity provider Configure Azure Entra ID as a SAML IdP so users authenticate via Azure instead of local Keycloak accounts.

Configure Google SAML as an identity provider Connect Google SAML using realmInitEnv bundle overrides, with no admin UI required.

Configure the CA truststore Replace the default DoD CA bundle with a custom certificate authority for X.509/CAC authentication.

Configure CRL-based certificate revocation in an airgap Load CRL files into Keycloak via an OCI data image so X.509/CAC revocation checks work without OCSP access.

Build a custom Keycloak configuration image Build, publish, and deploy a custom configuration image to UDS Core for theme or truststore changes.

Upgrade to FIPS 140-2 mode Migrate an existing non-FIPS deployment to FIPS 140-2 Strict Mode before upgrading UDS Core.

Manage Keycloak with OpenTofu Enable the built-in OpenTofu client and use it to programmatically manage Keycloak resources.