Keycloak: Realm & Client Configuration
In this post, we will see: step by step process to create a realm and configure a client with the protocol OpenId-Connect. If you want to understand keycloak key-concepts please check out Keycloak Essentials before going ahead.
1. Creating a realm:
let’s say “keycloak-demo” as an example. Avoid using the master realm for direct integration with the application, keep it for management only, and create a realm for all application integrations. You don’t have to create the realm every time. It’s a one-time process.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*jOk5R4YU16SGdh1w5rEKZg.png)
2. Clients:
Clients tab allows you to manage your allow application clients
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*rCXC710J13agnkdVNkM5ag.png)
3. Adding a Client:
It is simple to add a client, the same process works for any type of application.
- Client ID: You can give any suitable name for your application
- Protocol: ‘OpenID-Connect/SAML’
- Root Url: Application Hostname
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*X7gwlYVTHLzaEh_ygGbrQw.png)
4. Client Config
- A client using OpenID-Connect (Protocol)
Configure these two fields are important
- Valid Redirect Url: After Authentication where should keycloak redirect? (dependent upon Web Origin config, otherwise you will see an error: Invalid request URI)
- Web Origin: * or + ( * for wildcard redirection and + for domain-specific(validate all sub-domains): eg: *.redhat.com)
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*D3QtiCKscBo-KUPytAXo2g.png)
- A client using SAML (Protocol)
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*vJoQIsNupM2rft9qcqsFzQ.png)
5. Enabling User Registration:
Either you can enable User Registration or Add a user directly which can be used for testing.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*X99PNaMSQIaCur1gWNT-Ww.png)
6. Token
Setting SSO Session and Token Life Span, These settings are validated for the clients configured within the keycloak-demo realm. Make sure to keep token life span to be small and keep refresh token using updatetoken
` API.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*J1D7hB5sYe2cgqurqrr70Q.png)
Thanks for reading this post.