Skip to the rows

agentsclimarketplace

Keycloak administration

Skill Lukk17/agent-standards/.agents/skills/keycloak-administration

Keycloak identity and access management (IAM) administration guidance, realm management, client configuration, authentication flows, authorization policies, security hardening, and troubleshooting. Use when configuring Keycloak, setting up SSO, managing realms/clients, troubleshooting authentication issues, or implementing RBAC. Trigger phrases include "Keycloak", "SSO", "OIDC", "SAML", "identity provider", "IAM", "realm", "access management".From its SKILL.md

Install

npx -y skills add Lukk17/agent-standards --skill keycloak-administration

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

5.5 KB, ~1.2k tokens by cl100k_base, as published. Nobody here has run it

Keycloak Administration

Quick Start

Choose your task and load the appropriate reference:

New Installation → Continue below
Realm & User Management → Load realm-management.md
Client Configuration → Load client-configuration.md
Authentication & SSO → Load authentication-sso.md
Authorization & RBAC → Load authorization-rbac.md
User Federation (LDAP/AD) → Load user-federation.md
Security Hardening → Load security-hardening.md
High Availability & Scaling → Load ha-scalability.md
Troubleshooting → Load troubleshooting.md
Integration Examples → Load integration-examples.md

Installation & Setup

Docker (Recommended for Development)

docker run -d \
  --name keycloak \
  -p 8080:8080 \
  -e KEYCLOAK_ADMIN=admin \
  -e KEYCLOAK_ADMIN_PASSWORD=admin \
  quay.io/keycloak/keycloak:latest \
  start-dev

Production Mode

bin/kc.sh build --db=postgres

export KC_DB=postgres
export KC_DB_URL=jdbc:postgresql://localhost/keycloak
export KC_DB_USERNAME=keycloak
export KC_DB_PASSWORD=password
export KC_HOSTNAME=keycloak.example.com

bin/kc.sh start --optimized

Initial Configuration Checklist

Admin account: strong password (12+ chars)
Hostname: configure KC_HOSTNAME for production
SSL/TLS: required for production
Database: PostgreSQL recommended
SMTP: for email verification and password reset

Core Concepts

Concept	Description
Realm	Tenant boundary. Master realm for admin only; create app realms per environment
Client	Application registration. OIDC (modern) or SAML (legacy). Confidential (server) or Public (SPA/mobile)
User/Group	Identity with credentials. Groups for hierarchical organization
Realm Role	Global permission across all clients in a realm
Client Role	Permission scoped to a single client
Composite Role	Role that inherits other roles

Common Tasks

Configure SSO for an Application

Create OIDC client with your app's client-id
Set Valid Redirect URIs (exact URLs, avoid wildcards)
Set Client Authentication: On (confidential) or Off (public with PKCE)
Get discovery endpoint: {AuthServerUrl}/realms/{realm}/.well-known/openid-configuration
Integrate with your app: see client-configuration.md

Enable MFA

Authentication → Flows → Duplicate Browser flow
Add OTP or WebAuthn authenticator
Set as Required or Conditional
Bind custom flow to realm

Connect LDAP/Active Directory

User Federation → Add LDAP Provider
Configure: URL, Bind DN, Search Base (ou=users,dc=example,dc=com)
Set up attribute mappers
Test connection, then sync

Essential CLI Commands

# Admin CLI setup
bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin

# Realm operations
bin/kcadm.sh create realms -s realm=my-realm -s enabled=true
bin/kcadm.sh get realms/my-realm

# User operations
bin/kcadm.sh create users -r my-realm -s username=john -s enabled=true
bin/kcadm.sh set-password -r my-realm --username john --new-password secret

# Export/Import
bin/kc.sh export --dir /backup --realm my-realm
bin/kc.sh import --dir /backup

Best Practices

Realm separation: one realm per app/environment, never use Master for apps
Token lifespans: access tokens 5-15 min, refresh tokens based on use case
Public clients: always require PKCE
Roles: use groups for assignment, roles for permissions, composite roles for aggregation
Production security: SSL/TLS, brute force protection, MFA for admins, event logging

Reference Documentation

realm-management.md: Realms, users, groups, attributes, sessions
client-configuration.md: OIDC/SAML clients, scopes, mappers, service accounts
authentication-sso.md: Auth flows, MFA, identity brokering, social login
authorization-rbac.md: Roles, fine-grained authorization (UMA), policies, permissions
user-federation.md: LDAP/AD integration, sync, mappers, custom providers
security-hardening.md: Password policies, brute force, TLS, audit, production checklist
ha-scalability.md: Clustering, database tuning, caching, monitoring, backup/DR
troubleshooting.md: Login failures, token issues, LDAP sync, session problems, logging
integration-examples.md: .NET, Spring Boot, Node.js, token validation

What ships with it: 9 files

26.5 KB alongside SKILL.md

references/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.