Repository navigation
Replies: 8 comments 13 replies
|
To help discussions, here is the list of things we are planning to improve in the short term:
We would love to get feedback about the aforementioned items as well as to get feedback about the overall experience around the CLI and if you think it is the right path for making installation, configuration, and running instances easier and less verbose than the Wildfly distribution. See this design document for more details around Keycloak.X Configuration Model. |
|
It would be nice to have a CLI version to configure the initial admin user or setting it through a configuration file, etc. |
|
I second that. Current workaround is the following: #!/bin/bash
set -euo pipefail
# Requires httpie to enable container readiness check
hash http
# Start containers and wait for keycloak to be responsive
docker-compose up -d
while ! http --check-status --ignore-stdin --timeout=1 GET http://localhost:8180/auth/; do
echo "Waiting for Keycloak"
sleep 1
done
echo "Keycloak ready"
# Give admin user an email to enable verfication email sending
TOKEN=`http --form -v POST http://localhost:8180/auth/realms/master/protocol/openid-connect/token client_id=admin-cli username=admin password=foobar grant_type=password -b | jq -r '.access_token'`
ADMIN_ID=`http -v GET http://localhost:8180/auth/admin/realms/master/users "Authorization:Bearer $TOKEN" -b | jq -r '.[0].id'`
ADMIN_INFO='{"email": "admin@invalid"}'
echo $ADMIN_INFO | http -v PUT http://localhost:8180/auth/admin/realms/master/users/$ADMIN_ID "Authorization:Bearer $TOKEN"
http -v GET http://localhost:8180/auth/admin/realms/master/users/$ADMIN_ID "Authorization:Bearer $TOKEN" |
|
+1 There's two separate use-cases for that; 1) create the initial admin account, and 2) recovering access if you loose the admin password. I would like to rethink how we do those though, as I don't think it's super awesome how it works in WF distribution with the add-user-keycloak script today. |
|
@fabufab @Dudeplayz Please, take a look at #8549. |
|
@stianst @fabufab @Dudeplayz It also makes a lot of sense for me. We have KEYCLOAK-19412 to track this issue in particular. @stianst Shall we open another discussion to start gathering requirements and ideas? I think this one should be the start point for new ideas (such as the master admin) from which we derive discussions around a specific topic. |
|
I would like to propose a new command for managing providers. Something like: Where some examples of command could be:
It should also be possible to query provider configuration by:
I'm not 100% about the above though because we have the |
|
Would "providers list" also show the built-in providers, or only extensions? |
|
Might also be good to support some "filtering", something like: I know the last one doesn't make sense as it is, but you get the idea. |
|
@stianst
Answer: I'd say all at first sight, but maybe it's a good idea to default to custom in this case? Somewhat like this: and then wdyt? Your suggestion about filtering also makes sense for me. e.g. for hostname provider:
then running Just a note which comes to my mind: When we config the providers also via |
|
I agree with all the points here. I'll send a PR to the design document with what was discussed so far and once approved start the implementation. |
|
@pedroigor @DGuhr when we start looking at vault integration we should also support using secrets for things like DB passwords. |
|
Generally: For sure! |
|
I believe this concerns SPI config in general (mainly with regards to Store.X). It should be possible to somehow use creds from vault in an SPI config. WDYT? |
|
@stianst @DGuhr @vmuzikar I've created a thread on keycloak-dev about Vault support. See https://groups.google.com/g/keycloak-dev/c/0KqDnuKBWvA. |
|
The main issue in current configuration i think is a lack of incremental / partial / merge support. |
|
keycloak-config-cli is really great. I hope the way becomes a official default. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Please use #8654 instead
We would like to gather feedback from the community on how configuration is done in Keycloak.X.
Are there aspects that are you find confusing or complicated? Is there some things that you'd like to configure that is missing? Any other comments and suggestions are also welcome.
All reactions