Documentation

Support

Unity Cloud

Get Started

Creator SDKs and Services

Open Unity Dashboard

Unity Cloud

Set up the identity subsystem

Set up the identity subsystem, based on Keycloak
Read time 1 minuteLast updated 6 days ago
Unity Virtual Private Cloud includes an identity provider and broker component based on Keycloak. Keycloak includes these major capabilities:
  • Authentication and authorization
  • Storage of information about entities that is required for access control, for example, for users, service accounts, the organization, and projects
Keycloak is included in the above deployment, but you must perform customer-specific postdeployment tasks and administration tasks.

1. Access Keycloak

To access the Keycloak admin console from a browser, enter a URL in this format: 
https://<domain_name>/admin/master/console/
The default user is admin. To retrieve the password, run this command: 
kubectl get -n asset-solutions secret keycloak -o jsonpath="{.data.admin-password}" | base64 --decode

2. Complete the setup of the identity subsystem

To complete the setup of the identity subsystem, ensure that you are signed in to Keycloak, and then go to the unity realm.

2.1 Regenerate the secret for the 
mini-usf
client

To regenerate the secret, complete these steps:
  1. In the Keycloak admin console, switch to the unity realm.
  2. Go to Manage > Clients, and then select the mini-usf client.
  3. On the Credentials tab, select Regenerate next to the client secret.
  4. Copy the secret to the clipboard.
  5. Save the secret:
    1. Use the copied secret to redefine the keycloak_mini_usf_clientsecret variable in the directory 
      aws/terraform/tfvars/{region}.tfvars
      .
    2. From the directory 
      aws/terraform
      , run this command:
    make apply-us-east-1
  6. To restart the mini-usf pods in Kubernetes and apply the new secret, run this command: 
    kubectl rollout restart deployment -n asset-solutions mini-usf

2.2 Set up the URI properties for the dashboard client

To redirect the browser back to the frontend after a successful sign-in, add a valid redirect URI.
  1. Go to Manage > Clients, and then select the dashboard client.
  2. On the Settings tab, modify these values:
    • Set Root URI to 
      https://<solution-domain-name>
      .
    • Set Valid redirect URIs to 
      https://<solution-domain-name>/*
      .
  3. Select Save.

3. Perform administration tasks

  1. Create an organization in Keycloak.
  2. If required, set up single sign-on (SSO) for the identity subsystem.
  3. If you don't use SSO, then create users in Keycloak.
  4. Grant user access to the organization. Assign the Owner user type in the organization to at least one user, whether they have created their account locally or through SSO. This way, this user can sign in to Asset Manager and create a project. After you have completed these steps, users can access the application.
  5. Optionally, monitor integration in parallel or later.