Skip to main content

Keycloak

Use Keycloak to centralize Graph Studio user authentication where external Keycloak authentication is approved for the deployment. Keep Keycloak identity administration separate from Kubernetes and Graph Studio administration.

Use a dedicated realm and client​

The identity-provider owner should define the realm and client used by Graph Studio and retain control of their lifecycle.

  • Use a client dedicated to Graph Studio rather than sharing a client with unrelated applications.
  • Register only the exact Graph Studio redirect/callback URLs required by the deployment. Do not use broad wildcard redirect URIs.
  • Request only the scopes and claims that Graph Studio requires for the approved authentication design.
  • Define session and central-logout behavior with the identity-provider owner before enabling it for users.
  • Restrict who can alter the realm, client, redirect URIs, scopes, and authentication policy.

Protect the Keycloak connection​

Graph Studio must be able to validate the Keycloak server certificate.

  • Use HTTPS for the Keycloak endpoint.
  • Keep trustAll disabled. Do not bypass certificate validation for a production identity-provider endpoint.
  • When Keycloak uses a private or internal CA, configure the supported Graph Studio trust bundle for that CA rather than disabling trust validation.
  • Treat changes to the Keycloak host, certificate chain, or realm as controlled changes because they can prevent user authentication.

See Manage certificates and trusted CAs for the supported server-certificate and trustBundle configuration model.

Protect client credentials​

The Keycloak client secret is sensitive authentication material.

  • Obtain it from the approved secret-management process only at deployment time.
  • Do not commit the secret, a rendered custom resource, or a values file containing the secret to source control.
  • Limit access to the Graph Studio custom resource and any deployment artifacts containing the client secret.
  • Rotate the secret through the approved change process and update the Graph Studio deployment using the supported release configuration.

Supported Graph Studio configuration​

The Graph Studio operator configuration supports EXTERNAL_KEYCLOAK and Keycloak connection/client settings, including the host, TLS port, client ID, realm, client secret, callback user key, scope, trust behavior, and central logout setting.

For the release-specific configuration fields and a complete manifest, see Configure Keycloak authentication and imports. Do not copy its placeholder values as production values.

Authorization boundary​

This page describes authentication and client hardening. It does not define Keycloak group or claim mapping to Graph Studio product roles, default Graph Studio privileges, or a Keycloak server installation procedure. Confirm those behaviors for the selected Graph Studio and Keycloak releases before creating product-specific authorization policy.