> For the complete documentation index, see [llms.txt](https://ibm-developer.gitbook.io/get-started-with-security-for-your-java-microservi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ibm-developer.gitbook.io/get-started-with-security-for-your-java-microservi/setup-the-ibm-cloud-application-environment/setup_keycloak.md).

# Exercise 4: Setup Keycloak

These setup instractions are based on [Keycloak - Guide - Keycloak on Kubernetes](https://www.keycloak.org/getting-started/getting-started-kube).

The instructions go into installing an Ingress for Keycloak. But we have Istio installed and we will be using the Istio Ingress to access Keycloak externally. The original `keycloak.yaml` is modified and the `NodePort` has been removed.

Note: This is a "ephemeral" installation of Keycloak, there is no database used for persistance. Sufficient for a workshop but not suitable for production use!

## Step 1: Deploy Keycloak

```bash
cd $ROOT_FOLDER/IKS
kubectl apply -f keycloak.yaml
```

## Step 2: Wait until the Keycloak Pod is started

```bash
kubectl get pods
```

## Step 3: Access Keycloak

Get the Keycloak URL and open the URL in your browser:

```bash
echo "https://"$INGRESSURL"/auth"
```

Note: This will work because we created a VirtualService in the previous exercise that maps the `/auth` URI to the Keycloak service.

## Step 4: Try to logon to Keycloak

* Click on `Administration Console`.

![](https://1980280846-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFGEw-4BAG72jtDCP4q%2Fsync%2Faeecaaf076f80e908f50985ab0b2d328dee90017.png?generation=1598017434580225\&alt=media)

* Login In with username `admin` and password `admin`.

![](https://1980280846-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFGEw-4BAG72jtDCP4q%2Fsync%2Fc9f949b69cf03db3980e508204df845e54afef35.png?generation=1598017435416209\&alt=media)

## Step 5: Create realm

For the workshop we need our pre-configured realm, we will create the realm using a bash script.

* Verify your existing environment varibles

```bash
cd $ROOT_FOLDER/IKS
echo $MYCLUSTER
echo $INGRESSURL
echo $INGRESSSECRET
```

* Execute the bash script

```bash
bash keycloak-create-realm.sh
```

Example output:

```bash
------------------------------------------------------------------------
The realm is created.
Open following link in your browser:
https://harald-uebele-k8s-fra05-********************-0001/auth/admin/master/console/#/realms/quarkus
------------------------------------------------------------------------
```

## Step 6: Verify the newly created realm

Try to create an access token, this requires the $INGRESSURL environment variable to be set:

```bash
curl -d "username=alice" -d "password=alice" -d "grant_type=password" -d "client_id=frontend" https://$INGRESSURL/auth/realms/quarkus/protocol/openid-connect/token  | sed -n 's|.*"access_token":"\([^"]*\)".*|\1|p'
```

> *Note:* The image shows you in Kiali that we access Keycloak throuh our `istio-ingressgateway`. *This is not a part of your hands-on tasks.*

![](https://1980280846-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFGEw-4BAG72jtDCP4q%2Fsync%2Fbf196c39bab0a0c55d064bdb2a13e3501b4d3298.png?generation=1614769428340510\&alt=media)

> Congratulations, you have successfully completed the `Setup Application environment`. Awesome :star:

## Optional steps to verify the configuration

### STEP 1: Verify the name `quarkus`of the imported realm

![](https://1980280846-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFGEw-4BAG72jtDCP4q%2Fsync%2F2044cb0cbfbbee45f26b9c0d26c357c94ac21526.png?generation=1598017432356276\&alt=media)

### STEP 2: Verify the imported realm settings

![](https://1980280846-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFGEw-4BAG72jtDCP4q%2Fsync%2F758796e33dc38bcec6d811a1329538d129aed695.png?generation=1598017433534042\&alt=media)

### STEP 3: Press `view all users`

You should see following users: `admin`, `alice`, `jdoe`

![](https://1980280846-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFGEw-4BAG72jtDCP4q%2Fsync%2Fe9d0bd4f9888518ea985351e9930ee5cca5c5ce6.png?generation=1598017431783584\&alt=media)

### STEP 4: Verify the role mapping

![](https://1980280846-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFGEw-4BAG72jtDCP4q%2Fsync%2Fc029e1031b87e413e62295b4f1be382a24bc2c2a.png?generation=1598017436567574\&alt=media)