Set up the identity subsystem
Set up the identity subsystem, based on Keycloak
Read time 1 minuteLast updated 12 days ago
Unity Virtual Private Cloud includes an identity provider and broker component based on Keycloak. Keycloak includes these major capabilities:
- Authentication and authorization
- Storage of information about entities that is required for access control, for example, for users, service accounts, the organization, and projects
1. Access Keycloak
In Keycloak, the predefined unity realm stores all the settings and objects that are related to Virtual Private Cloud. When you open the Keycloak admin console, switch to the unity realm.Prerequisites for the first access
This step is required only the first time you access the Keycloak admin console. Initialize the AKS cluster credentials on the administrator's machine. Refer to the procedure in the Azure documentation. These credentials are required later. You must have the Azure Kubernetes Service RBAC Cluster Admin role for the cluster. This role must be directly assigned to you or inherited from a parent resource, such as the resource group.Access the admin console
To access the Keycloak admin console from a browser, use Kubernetes port forwarding:-
To establish a port forwarding session to Keycloak, run this command:
kubectl port-forward -n asset-solutions service/keycloak 8080:80
-
In the browser, enter this URL:
http://127.0.0.1:8080/auth/admin
Manage the admin password
The initial administrator username isadmin
kc-admin-password
- Grant the Key Vault Administrator role to themselves, because the Owner role doesn't provide access to the Key Vault data plane
- Temporarily allow access to the key vault over the internet By default, public access for this key vault is made unavailable. The recommended practice is to restrict this access to the IPs of specific administrators, in the key vault firewall settings, and, if possible, permanently.
-
Change the password for the user. The recommended practice is to keep the password up-to-date in the key vault.
admin
- Add administrative users.
2. Perform administration tasks
To perform administation tasks, complete these steps:- Ensure that you are signed in to Keycloak, and then go to the unity realm.
- If required, set up single sign-on (SSO) for the identity subsystem.
- If you don't use SSO, then create users in Keycloak.
- Grant user access to the organization. Assign the Owner user type in the organization to at least one user, whether they have created their account locally or through SSO. This way, this user can sign in to Asset Manager and create a project. After you have completed these steps, users can access the application.
- Optionally, monitor integration in parallel or later.