AWS Marketplace

Usage instructions

Getting started

Launch the product via 1-Click

Use a web browser to access the Admin console at: https://[ec2-ip]:8443, where [ec2_ip] is the public ip provided by Amazon for your instance.

Log in using the following credentials:

Username: admin

Password: the instance_id of the instance

You can also access your instance via SSH using the username and your Amazon private key.

The username depends on the operative system:

  - Centos 9 Stream: 'ec2-user'

  - Other Centos: 'centos'

  - Ubuntu: 'ubuntu'

  - Rocky Linux: 'rocky'

Installation details

Keycloak installed with wildfly distribution.

In versions prior to 19.0.1, we install Keyckloak embedded within the wildfly application server

The configuration files are located inside the embedded WildFly, that is, in the directory $KEYCLOAK_HOME where KEYCLOAK_HOME is /usr/java/keycloak.

For more details on the installation, you can refer to the documentation at https://www.keycloak.org/docs/latest/server_installation/index.html

Keycloak installed with the Quarkus distribution.

From version 19.0.1, we install Keycloak with Quarkus as the distribution with WildFly is deprecated.

The configuration file is located in the directory $KEYCLOAK_HOME/conf/keycloak.conf where $KEYCLOAK_HOME is /usr/java/keycloak.

For more details on the installation, you can refer to the documentation at https://www.keycloak.org/docs/latest/server_installation/index.html

Configuración  de TLS en Keycloak

By default, we have created a self-signed certificate using Java Keystore so it's not validated by any authority (by default, the Keycloak server looks for the file $KEYCLOAK_HOME/conf/server.keystore).

If you want to obtain a valid certificate, you will need to request one from a certificate authority and make the necessary changes in Keycloak.

Service configuration

Server service is configured with systemd.

The Keycloak service is in /etc/systemd/system/keycloak.service, which indicates whether to start Keycloak in development or production mode:

If you have chosen Keycloak with H2, the service will start in development mode: ExecStart=/usr/java/keycloak/bin/kc.sh start-dev

If you have chosen Keycloak with MySQL or PostgreSQL, the service is started for production mode: ExecStart=/usr/java/keycloak/bin/kc.sh start

View status server:

[centos@ip-172-31-9-232 etc]$ sudo systemctl status keycloak

Stop server:

[centos@ip-172-31-9-232 etc]$ sudo systemctl stop keycloak

Start server:

[centos@ip-172-31-9-232 etc]$ sudo systemctl start keycloak

Data persistence modes

H2 (Default)

Keycloak comes with its own embedded Java-based relational database called H2. Usually recommended for development environments, for production environments it is recommended to work with better relational databases.

We provide products with MySQL or PostgreSQL.

MySQL

Keycloak is configured with a MySQL database.

PostgreSQL

Keycloak is configured with a PostgreSQL database.

MySQL

View service status:

$ sudo systemctl status  mysql

Stop service:

$ sudo systemctl stop mysql

Start service:

$ sudo systemctl start mysql

Access the MySQL console from your terminal:

$ sudo mysql

PostgreSQL

View service status:

$ sudo systemctl status  postgresql

Stop service:

$ sudo systemctl stop postgresql

Start service:

$ sudo systemctl start postgresql

Access the MySQL console from your terminal:

$ sudo -u postgres psql

Other useful data

Location of sensitive information

All the information is saved in the database.

In MySQL the data folder is /var/lib/mysql

In PostgreSQL the data folder is /var/lib/pgsql/data

Encryption configuration

There is no encrypted data.

Changing system credentials

To change the Kecycloak credentials you have to go to the menu on the right, users, credentials and press the reset button.

Instructions on how the user interacts with Keycloak to decrypt necessary data

You can use the Keycloak management console to view all necessary data.

How to assess and monitor the health and proper function of the application.

1. Navigate to your Amazon EC2 console and verify that you're in the correct region.

2. Choose Instance and select your launched instance.

3. Select the server to display your metadata page and choose the Status checks tab at the bottom of the page to review if your status checks passed or failed.

Additional resources

https://www.keycloak.org/

https://www.keycloak.org/server/enabletls 

https://www.keycloak.org/server/configuration