defenseunicorns / defenseunicorns/uds-core

Revisit Keycloak initial admin bootstrap experience

Open
#2,011 2 comments 0 reactions 1 assignee Claimed by @slaskawi View on GitHub
design-doc enhancement
Dominant language
TypeScript
Stars
193
Forks
45
Avg merge
3d 8h
Merged PRs (30d)
60

Description

## Summary

As of today, the UDS Core provides Keycloak without an initial Admin account. Users typically have to use `uds zarf connect keycloak` to create an account, which is used for further Keycloak management.

The goal of this ticket is to rethink the above User Experience and consider alternative workflows.

## Alternatives to consider

- Keycloak offers [Dedicated Realm Admin Consoles](https://www.keycloak.org/docs/latest/server_admin/index.html#_per_realm_admin_permissions). This mechanism could be used to expose the `uds` console and leave the `master` one intacted (without creating a Keycloak `master` Realm account). As a technical note - this may require creating a user account to prevent the Welcome Page from being displayed.
- Realm Import mechanism provides a way to supply the `master` Realm. This way, the UDS Core can supply all required configuration changes (including Admin Accounts).
- A Realm Import with an Admin Account configured with 1-time password can be used to provide good bootstrap UX.
- We may also consider disabling the `master` Realm algothether (e.g. by disabling certain Clients used to log in).
- Consider Initial Access Token to enable Tofu create the initial Client.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.