In short: To use Keycloak as an external identity provider (IdP) for a remote signing solution, install it under /opt, run it as a systemd service with an SSL certificate and open it at https://localhost:8443/. This guide walks through each step, from the start script and service unit to the SSL settings and an optional non-SSL mode for testing.
In today’s digitally-driven world, secure identity and access management are paramount. Integrating an Identity Provider (IDP) such as Keycloak into your system not only enhances security but also streamlines user authentication processes. This blog post will guide you through the steps of configuring Keycloak as an External IDP for a remote signing solution. Let’s dive in!
Download and Setup Keycloak
- Download Keycloak : Begin by downloading the Keycloak distribution package from the official website or your preferred source.
- Unzip the Package : Once downloaded, unzip the package to your desired location on your system.
- Move Keycloak Directory : Move the unzipped Keycloak directory to the /opt directory, a common location for installing applications.
Create Script File
- Create a Script File : In the terminal, create a script file named keycloak.sh in /usr/bin using your favorite text editor. Add the following content to the file:
- #!/bin/bash
- echo “############################################”
- echo “Starting Keycloak service”
- cd /opt/keycloak-22.0.1/bin
- # Set up environment variables
- export KEYCLOAK_HTTPS_CERTIFICATE_FILE=/opt/keycloak-22.0.1/conf/keycloak.pem
- export KEYCLOAK_HTTPS_CERTIFICATE_KEY_FILE=/opt/keycloak-22.0.1/conf/keycloak_key.pem
- # Start Keycloak with SSL enabled (production mode)
- ./kc.sh start
Configure Keycloak as a Service
- Create a Script File : In the terminal, create a script file named keycloak.sh in /usr/bin using your favorite text editor. Add the following content to the file:
- [Unit]
- Description=Keycloak Service
- After=network-online.target
- Wants=network-online.target systemd-networkd-wait-online.service
- [Service]
- Restart=on-abnormal
- Environment=”KEYCLOAK_ADMIN=admin”
- Environment=”KEYCLOAK_ADMIN_PASSWORD=admin”
- User=root
- Group=root
- ExecStart=/usr/bin/startkeycloak.sh
- [Install]
- WantedBy=multi-user.target
Enable and Start Keycloak Service
- Enable and Start the Service : Reload systems to recognize the new service unit, then enable and start the Keycloak service :
- sudo systemctl daemon-reload
- sudo systemctl enable keycloak
- sudo systemctl start keycloak
Access Keycloak in Your Web Browser
- Access Keycloak : Keycloak is now running as a service on your system. You can access it via a web browser using the following URLs:
- HTTP: http://localhost:8080/
- HTTPS: https://localhost:8443/
Configure Keycloak for SSL
- Add SSL Certificate Path : Update the keycloak.conf file and the keycloak.sh file with the SSL certificate path as environment variables.
Configure Keycloak for Non-SSL (Optional)
- Use Keycloak without SSL : If you prefer to use Keycloak without SSL, follow these steps:
- cd /opt/keycloak/bin
- ./kcadm.sh config credentials –server http://localhost:8080 –realm master –user admin –password admin
- ./kcadm.sh update realms/master -s sslRequired=NONE
By following these steps, you can seamlessly integrate Keycloak as an External IDP for your remote signing solution, ensuring robust security and streamlined access management. Unlock the potential of secure authentication with Keycloak today!
