# Set up the identity subsystem

> Set up the identity subsystem, based on Keycloak

Unity Virtual Private Cloud includes an identity provider and broker component based on Keycloak. Keycloak includes these major capabilities:

* Authentication and authorization
* Storage of information about users and service accounts keys

Keycloak is included in the above deployment, but you must perform customer-specific postdeployment and administration tasks.

## 1. Access Keycloak

In Keycloak, the predefined **unity** realm stores all the settings and objects that are related to Virtual Private Cloud. When you open the [Keycloak admin console](/cloud/virtual-private-cloud/admin/keycloak-admin-console.md.md), switch to the **unity** realm.

#### Access the admin console

To access the Keycloak admin console from a browser, enter a URL in the following format:

```text
https://<SolutionFQDN>/auth/admin
```

Replace `<SolutionFQDN>` with your solution's fully qualified domain name (FQDN).

#### Retrieve initial admin password

The initial administrator username is `admin`. Azure generates the password during deployment. Retrieve the password from the solution key vault. The key vault is in the solution managed resource group, and the secret name is `kc-admin-password`.

To access secrets in the key vault, an administrator might require to perform these tasks:

* Grant the Key Vault Administrator role to themselves, because the Owner role doesn't provide access to the Key Vault data plane
* Temporarily allow access to the key vault over the internet

  By default, public access for this key vault is made unavailable. The recommended practice is to restrict this access to the IPs of specific administrators, in the key vault firewall settings, and, if possible, permanently.

#### Manage administrative access

Optionally, in the **master** realm, perform these actions:

1. Change the password for the `admin` user.

   The recommended practice is to keep the password up-to-date in the key vault.

2. Add the administrative users, as personal accounts for specific solution administrators.

To perform other changes that are related to Virtual Private Cloud settings, go to the **unity** realm.

## 2. Change the default admin credentials

The keycloak admin credentials are static and aren't tied to any identity provider.

When you sign in for the first time, change the default admin credentials:

1. In the Keycloak admin console, switch to the default realm, that is, the **master** realm.
2. Go to **Users**, and then select the `admin` user.
3. On the **Credentials** tab, select **Reset password**.
4. Enter a new password.
5. Turn off **Temporary**.
6. Record the credentials somewhere secure.

## 3. Perform administration tasks

Perform these steps to finalize solution configuration:

1. Complete the [initial solution onboarding](/cloud/virtual-private-cloud/admin/solution-onboarding.md.md).

2. If required, [set up single sign-on (SSO)](/cloud/virtual-private-cloud/admin/single-sign-on.md.md) for the identity subsystem.

3. If you don't use SSO, then [create users](/cloud/virtual-private-cloud/admin/users-service-accounts/create-user.md.md) in Keycloak.

4. [Grant user access](/cloud/virtual-private-cloud/admin/users-service-accounts/manage-access-for-user.md.md) to the organization.

5. Optionally, configure monitoring integration in parallel or later.

After you have completed these steps, users can access the application.

## Next steps

[Azure Monitor integration](./monitor-integration.md)