ドキュメント

Self-Hosted Deployment

Deploy on Kubernetes (recommended)

shdctl

AWS Terraform package

Azure Marketplace

Self-Hosted Deployment

Set up the identity subsystem

Set up the identity subsystem, based on Keycloak
読み終わるまでの所要時間 1 分最終更新 5日前
Self-Hosted Deployment includes an identity provider and broker based on Keycloak, which handles authentication and authorization, and stores information about users and service account keys. The deployment installs Keycloak, but you complete its customer-specific postdeployment and administration tasks.

1. Access Keycloak

Access the Keycloak admin console at 
https://<your-domain>/auth/admin/master/console/
. Sign in to the master realm as 
admin
. The initial password is the 
keycloak.adminPassword
value in 
generated-charts/keycloak/values.yaml
, the file that 
shdctl release generate
writes. Change it right away, as the next section describes.

Change the default admin credentials

The keycloak admin credentials are static and aren't tied to any identity provider.
When you sign in for the first time, change the default admin credentials:
  1. In the Keycloak admin console, switch to the default realm, that is, the master realm.
  2. Go to Users, and then select the 
    admin
    user.
  3. On the Credentials tab, select Reset password.
  4. Enter a new password.
  5. Turn off Temporary.
  6. Record the credentials somewhere secure.

2. Complete the setup of the identity subsystem

To complete the setup of the identity subsystem, ensure that you are signed in to Keycloak, and then go to the unity realm.

2.1 Set up the URI properties for the dashboard client

To redirect the browser back to the frontend after a successful sign-in, add a valid redirect URI.
  1. Go to Manage > Clients, and then select the dashboard client.
  2. On the Settings tab, modify these values:
    • Set Root URI to 
      https://<solution-domain-name>
      .
    • Set Valid redirect URIs to 
      https://<solution-domain-name>/*
      .
  3. Select Save.

3. Perform administration tasks

  1. Complete the initial solution onboarding.
  2. If required, set up single sign-on (SSO) for the identity subsystem.
  3. If you don't use SSO, then create users in Keycloak.
  4. Grant user access to the organization.
  5. Optionally, configure monitoring integration in parallel or later.
After you have completed these steps, users can access the application.