defenseunicorns / defenseunicorns/uds-core
Revisit Keycloak initial admin bootstrap experience
- Dominant language
- TypeScript
- Stars
- 193
- Forks
- 45
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 60
Description
## Summary
As of today, the UDS Core provides Keycloak without an initial Admin account. Users typically have to use `uds zarf connect keycloak` to create an account, which is used for further Keycloak management.
The goal of this ticket is to rethink the above User Experience and consider alternative workflows.
## Alternatives to consider
- Keycloak offers [Dedicated Realm Admin Consoles](https://www.keycloak.org/docs/latest/server_admin/index.html#_per_realm_admin_permissions). This mechanism could be used to expose the `uds` console and leave the `master` one intacted (without creating a Keycloak `master` Realm account). As a technical note - this may require creating a user account to prevent the Welcome Page from being displayed.
- Realm Import mechanism provides a way to supply the `master` Realm. This way, the UDS Core can supply all required configuration changes (including Admin Accounts).
- A Realm Import with an Admin Account configured with 1-time password can be used to provide good bootstrap UX.
- We may also consider disabling the `master` Realm algothether (e.g. by disabling certain Clients used to log in).
- Consider Initial Access Token to enable Tofu create the initial Client.
Contributor guide
Assessment
This issue has not been assessed yet.