Overview

These guides walk platform engineers through common identity and access tasks in UDS Core. Each guide covers a single goal with step-by-step instructions.

For background on how Keycloak, Authservice, and SSO work together, see Identity & Authentication concepts.

Guides

Protect non-OIDC apps with SSO Add SSO protection to applications that have no native OIDC support.

Enforce group-based access controls Restrict application access to users in specific Keycloak groups using the Package CR.

Configure Keycloak authentication methods Enable or disable username/password, X.509/CAC, WebAuthn, OTP, and social login via bundle overrides.

Connect Azure AD as an identity provider Configure Azure Entra ID as a SAML IdP so users authenticate via Azure instead of local Keycloak accounts.

Configure Google SAML as an identity provider Connect Google SAML using realmInitEnv bundle overrides — no admin UI required.

Configure Keycloak login policies Set session timeouts, concurrent session limits, and logout behavior via bundle overrides.

Configure Keycloak HTTP retries Enable and tune retry behavior for Keycloak outbound HTTP requests to external services.

Configure the CA truststore Replace the default DoD CA bundle with a custom certificate authority for X.509/CAC authentication.

Configure service account clients Set up machine-to-machine authentication using the OAuth 2.0 Client Credentials Grant.

Configure OAuth 2.0 device flow Enable device authorization for CLI tools and headless apps that cannot use a browser redirect.

Configure Keycloak account lockout Set temporary and permanent lockout thresholds for brute-force protection.

Customize Keycloak login page branding Replace the default logos, background, and Terms & Conditions content via bundle overrides and ConfigMaps.

Build a custom Keycloak configuration image Build, publish, and deploy a custom configuration image to UDS Core for theme or truststore changes.

Configure user accounts and security policies Set password complexity, enable email verification, and extend security hardening allow lists via bundle overrides.

Manage Keycloak with OpenTofu Enable the built-in OpenTofu client and use it to programmatically manage Keycloak resources.

Upgrade to FIPS 140-2 mode Migrate an existing non-FIPS deployment to FIPS 140-2 Strict Mode before upgrading UDS Core.