agentsclimarketplace

Keycloak administration

Skill Lukk17/agent-standards/.agents/skills/keycloak-administration

One git checkout drops a shared AI coding setup (skills, subagents, MCP servers, OpenSpec scaffolding) into any project, across Claude Code, Kilo, OpenCode, Codex, and Copilot.

Install
npx -y skills add Lukk17/agent-standards --skill keycloak-administration

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Keycloak identity and access management (IAM) administration guidance, realm management, client configuration, authentication flows, authorization policies, security hardening, and troubleshooting. Use when configuring Keycloak, setting up SSO, managing realms/clients, troubleshooting authentication issues, or implementing RBAC. Trigger phrases include "Keycloak", "SSO", "OIDC", "SAML", "identity provider", "IAM", "realm", "access management".

SKILL.md

5.5 KB, ~1.2k tokens by cl100k_base, as published. Nobody here has run it

Keycloak Administration

Quick Start

Choose your task and load the appropriate reference:

  1. New Installation → Continue below
  2. Realm & User Management → Load realm-management.md
  3. Client Configuration → Load client-configuration.md
  4. Authentication & SSO → Load authentication-sso.md
  5. Authorization & RBAC → Load authorization-rbac.md
  6. User Federation (LDAP/AD) → Load user-federation.md
  7. Security Hardening → Load security-hardening.md
  8. High Availability & Scaling → Load ha-scalability.md
  9. Troubleshooting → Load troubleshooting.md
  10. Integration Examples → Load integration-examples.md

Installation & Setup

Docker (Recommended for Development)

docker run -d \
  --name keycloak \
  -p 8080:8080 \
  -e KEYCLOAK_ADMIN=admin \
  -e KEYCLOAK_ADMIN_PASSWORD=admin \
  quay.io/keycloak/keycloak:latest \
  start-dev

Production Mode

bin/kc.sh build --db=postgres

export KC_DB=postgres
export KC_DB_URL=jdbc:postgresql://localhost/keycloak
export KC_DB_USERNAME=keycloak
export KC_DB_PASSWORD=password
export KC_HOSTNAME=keycloak.example.com

bin/kc.sh start --optimized

Initial Configuration Checklist

  1. Admin account: strong password (12+ chars)
  2. Hostname: configure KC_HOSTNAME for production
  3. SSL/TLS: required for production
  4. Database: PostgreSQL recommended
  5. SMTP: for email verification and password reset

Core Concepts

ConceptDescription
RealmTenant boundary. Master realm for admin only; create app realms per environment
ClientApplication registration. OIDC (modern) or SAML (legacy). Confidential (server) or Public (SPA/mobile)
User/GroupIdentity with credentials. Groups for hierarchical organization
Realm RoleGlobal permission across all clients in a realm
Client RolePermission scoped to a single client
Composite RoleRole that inherits other roles

Common Tasks

Configure SSO for an Application

  1. Create OIDC client with your app's client-id
  2. Set Valid Redirect URIs (exact URLs, avoid wildcards)
  3. Set Client Authentication: On (confidential) or Off (public with PKCE)
  4. Get discovery endpoint: {AuthServerUrl}/realms/{realm}/.well-known/openid-configuration
  5. Integrate with your app: see client-configuration.md

Enable MFA

  1. Authentication → Flows → Duplicate Browser flow
  2. Add OTP or WebAuthn authenticator
  3. Set as Required or Conditional
  4. Bind custom flow to realm

Connect LDAP/Active Directory

  1. User Federation → Add LDAP Provider
  2. Configure: URL, Bind DN, Search Base (ou=users,dc=example,dc=com)
  3. Set up attribute mappers
  4. Test connection, then sync

Essential CLI Commands

# Admin CLI setup
bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin

# Realm operations
bin/kcadm.sh create realms -s realm=my-realm -s enabled=true
bin/kcadm.sh get realms/my-realm

# User operations
bin/kcadm.sh create users -r my-realm -s username=john -s enabled=true
bin/kcadm.sh set-password -r my-realm --username john --new-password secret

# Export/Import
bin/kc.sh export --dir /backup --realm my-realm
bin/kc.sh import --dir /backup

Best Practices

  • Realm separation: one realm per app/environment, never use Master for apps
  • Token lifespans: access tokens 5-15 min, refresh tokens based on use case
  • Public clients: always require PKCE
  • Roles: use groups for assignment, roles for permissions, composite roles for aggregation
  • Production security: SSL/TLS, brute force protection, MFA for admins, event logging

Reference Documentation

Gives 0 of the 12 instructions most security skills give in ~1.2k tokens

Counted across 648 of the 828 authors here whose files we hold, read 2026-08-06

  • parameterize all database queriesin 67 of 648, across 49 files
  • hash passwords using bcrypt scrypt or argon2in 48 of 648, across 35 files
  • apply rate limiting to authentication endpointsin 48 of 648, across 24 files
  • Configure security headersin 35 of 648, across 18 files
  • validate all inputsin 32 of 648, across 24 files
  • validate all external input at the system boundaryin 29 of 648, across 18 files
  • run containers as a non-root userin 28 of 648, across 15 files
  • use httponly secure samesite cookies for sessionsin 26 of 648, across 15 files
  • run dependency audits before every releasein 21 of 648, across 10 files
  • encode output to prevent cross-site scriptingin 21 of 648, across 10 files
  • copy dependencies before source codein 20 of 648, across 9 files
  • store secrets in environment variablesin 20 of 648, across 17 files

Said here and by no other author read

  • use postgresql for production
  • enable ssl tls for production
  • configure smtp for email verification
  • create one realm per app environment
  • never use the master realm for apps
  • avoid wildcards in valid redirect uris

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.