Chapter 3. Configuring realms

Procedure

1. Click Realm settings in the menu.

2. Click the Login tab.

   Login tab

   

3. Toggle Forgot password to ON.

   A Forgot Password? link displays in your login pages.

   Forgot password link

   

4. Specify Host and From in the Email tab in order for Red Hat build of Keycloak to be able to send the reset email.

5. Click this link to bring users where they can enter their username or email address and receive an email with a link to reset their credentials.

   Forgot password page

   

Procedure

1. Click Authentication in the menu.
2. Click the Flows tab.

3. Select the Reset Credentials flow.

   Reset credentials flow

   

   If you do not want to reset the OTP, set the Reset - Conditional OTP sub-flow requirement to Disabled.

   Send Reset Email Configuration

   

   If you want to change default behavior for the force login option, click the Send Reset Email settings icon in the flow, define an Alias, and select the best Force login after reset option for you (true, always force re-authentication, false, keep the user logged in if the same browser was used, only-federated, default value that forces login again only for federated users).

4. Click Authentication in the menu.
5. Click the Required actions tab.

6. Ensure Update Password is enabled.

   Required Actions

   

Procedure

1. Click Realm settings in the menu.
2. Click the Login tab.

3. Toggle the Remember Me switch to On.

   Login tab

   

   When you save this setting, a remember me checkbox displays on the realm’s login page.

   Remember Me

   

Procedure

1. Select the realm in the Admin Console.
2. Click Realm settings in the menu.
3. Click the Keys tab.
4. Click the Providers tab.
5. Click Add provider and select rsa-generated.
6. Enter a number in the Priority field. This number determines if the new key pair becomes the active key pair. The highest number makes the key pair active.
7. Select a value for AES Key size.
8. Click Save.

Procedure

1. Select the realm in the Admin Console.
2. Click Realm Settings.

3. Click the Keys tab.

   A list of Active keys appears.

4. On a row with an RSA key, click Certificate under Public Keys.

   The certificate appears in text form.

5. Save the certificate to a file and enclose it in these lines.

   ----Begin Certificate----
   <Output>
   ----End Certificate----

   Copy to Clipboard Toggle word wrap
6. Use the keytool command to convert the key file to PEM Format.

7. Remove the current RSA public key certificate from the keystore.

   keytool -delete -keystore <keystore>.jks -storepass <password> -alias <key>

   Copy to Clipboard Toggle word wrap

8. Import the new certificate into the keystore

   keytool -importcert -file domain.crt -keystore <keystore>.jks -storepass <password>  -alias <key>

   Copy to Clipboard Toggle word wrap

9. Rebuild the application.

   mvn clean install wildfly:deploy

   Copy to Clipboard Toggle word wrap

Procedure

1. Select the realm in the Admin Console.
2. Click Realm settings.
3. Click the Keys tab.
4. Click the Providers tab.
5. Click Add provider and select rsa.
6. Enter a number in the Priority field. This number determines if the new key pair becomes the active key pair.
7. Click Browse…​ beside Private RSA Key to upload the private key file.
8. If you have a signed certificate for your private key, click Browse…​ beside X509 Certificate to upload the certificate file. Red Hat build of Keycloak automatically generates a self-signed certificate if you do not upload a certificate.
9. Click Save.

Procedure

1. Select the realm in the Admin Console.
2. Click Realm settings in the menu.
3. Click the Keys tab.
4. Click the Providers tab.
5. Click Add provider and select java-keystore.
6. Enter a number in the Priority field. This number determines if the new key pair becomes the active key pair.
7. Enter the desired Algorithm. Note that the algorithm should match the key type (for example RS256 requires a RSA private key, ES256 a EC private key or AES an AES secret key).
8. Enter a value for Keystore. Path to the keystore file.
9. Enter the Keystore Password. The option can refer a value from an external vault.
10. Enter a value for Keystore Type (JKS, PKCS12 or BCFKS).
11. Enter a value for the Key Alias to load from the keystore.
12. Enter the Key Password. The option can refer a value from an external vault.
13. Enter a value for Key Use (sig for signing or enc for encryption). Note that the use should match the algorithm type (for example RS256 is sig but RSA-OAEP is enc)
14. Click Save.

Procedure

1. Select the realm in the Admin Console.
2. Click Realm settings in the menu.
3. Click the Keys tab.
4. Click the Providers tab.
5. Click the provider of the key you want to make passive.
6. Toggle Active to Off.
7. Click Save.

Procedure

1. Select the realm in the Admin Console.
2. Click Realm settings in the menu.
3. Click the Keys tab.
4. Click the Providers tab.
5. Click the provider of the key you want to make passive.
6. Toggle Enabled to Off.
7. Click Save.

Procedure

1. Click Clients in the menu.
2. Click security-admin-console.
3. Scroll down to the Access settings section.
4. Fill in the Admin URL field.
5. Click the Advanced tab.
6. Click Set to now in the Revocation section.
7. Click Push.