Keycloak
Purpose
Loads identity data from Keycloak: realms, users, groups, roles, clients, identity providers, organizations, and authentication flows.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
important
If your Keycloak instance is on-premise or behind a private network, set tailscale_hostname and run the collector via a SubImage Outpost.
Required Fields
| Field | Secret? | Description |
|---|---|---|
keycloak_url |
No | Keycloak base URL, e.g. https://keycloak.example.com |
keycloak_realm |
No | Realm used to authenticate the service account (all realms will be synced) |
keycloak_client_id |
No | Client ID with Service Accounts Enabled |
keycloak_client_secret |
Yes | Client secret of the service-account client |
tailscale_hostname |
No | (Optional) Internal hostname resolved via Outpost |
Setup Steps
- In the Keycloak admin console, open the realm you will use to authenticate
(
keycloak_realm). - Create a confidential client with Client authentication ON and Service accounts roles ON.
- In the client's Service Account Roles tab, assign the
realm-managementrolesview-realm,view-users,view-clients, andview-identity-providersfor every realm you want SubImage to read. - Copy the client ID and client secret (under Credentials) into SubImage.
- Set
keycloak_urlto the public base URL of the Keycloak server (no trailing path).
The sync is read-only.