{"templateId":"markdown","versions":[{"version":"v1.40","label":"v1.40 STS","link":"/products/custody/deployment/reference/keycloak","default":true,"active":false,"folderId":"c15a2701"},{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/v1.39/deployment/reference/keycloak","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/deployment/reference/keycloak","default":false,"active":true,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/deployment/reference/keycloak","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/deployment/reference/keycloak","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/deployment/reference/keycloak","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/deployment/reference/keycloak","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Keycloak configuration","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"keycloak-configuration","__idx":0},"children":["Keycloak configuration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this page to understand the main Keycloak configuration fields used by ","Ripple Custody",". The example shows one possible component configuration; your realm setup, identity-provider integration, resource values, hosts, and secrets depend on your deployment."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page applies to on-premise deployments only. For current defaults and the full supported schema, use the configuration packaged with your release."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-this-config-controls","__idx":1},"children":["What this config controls"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Keycloak provides identity and access management for ","Ripple Custody",". Deployment configuration controls the Keycloak service, resource values, database connectivity, admin credentials, secret references, and ingress exposure."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OIDC provider federation is configured in Keycloak after deployment. For the federation model and setup steps, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/sso"},"children":["Federated identity and SSO"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/sso/keycloak-integration"},"children":["Configure OIDC federation in Keycloak"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For Keycloak runtime controls configured outside the deployment values, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/sso/keycloak-session-limiting"},"children":["Keycloak session limiting"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/sso/keycloak-inactivity-timeout"},"children":["Keycloak inactivity timeout"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"environment-variables","__idx":2},"children":["Environment variables"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Variable"},"children":["Variable"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Default or source"},"children":["Default or source"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KC_DB_SCHEMA"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Database schema name."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["openid"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KC_DB_URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JDBC connection URL."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KC_LOG_LEVEL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keycloak log level."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["info"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KEYCLOAK_ADMIN"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Admin username."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KEYCLOAK_ADMIN_PASSWORD"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Admin password."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KC_BOOTSTRAP_ADMIN_USERNAME"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Bootstrap admin username."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["KC_BOOTSTRAP_ADMIN_PASSWORD"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Bootstrap admin password."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Database, host, OAuth provider, and integration URLs are managed by the deployment configuration and should not be set manually unless your release explicitly exposes those fields."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"component-fields","__idx":3},"children":["Component fields"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Location: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["components.keycloak"]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["enabled"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enables the Keycloak component."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["replicas"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Number of Keycloak replicas."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resources.limits"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["CPU and memory limits for the Keycloak pod."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resources.requests"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["CPU and memory requests for the Keycloak pod."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secrets.psql.secretRef"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret reference for database connection values."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secrets.kc.secretRef"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret reference for admin and bootstrap credentials."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secrets.oidc-credentials.secretRef"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret reference for OIDC credentials."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secrets.clients.secretRef"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret reference for internal client secrets."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ingress.main"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ingress settings for the Keycloak endpoint."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Resource values are workload-dependent. Set them based on your expected authentication load and observed runtime behavior."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"admin-configuration","__idx":4},"children":["Admin configuration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Location: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["harmonize.keycloak"]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin.name"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keycloak admin username."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin.password"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keycloak admin password. An empty value can be generated by the deployment process when supported."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["realmAdmin.name"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Realm admin username."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["realmAdmin.secret"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Realm admin secret. An empty value can be generated by the deployment process when supported."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"secrets","__idx":5},"children":["Secrets"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Keycloak admin credentials and database credentials are supplied through Kubernetes secrets. For the expected secret names and keys, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/reference/auth-secrets"},"children":["Secret management for authentication"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Keycloak stores some realm and client configuration in its database. When rotating a client secret or identity-provider secret, update the value where Keycloak stores it and verify any Kubernetes secret consumed by dependent components. Updating only one side can leave the deployment with mismatched secrets."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"database","__idx":6},"children":["Database"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Keycloak and OAuth use PostgreSQL for persistent storage. Each component uses its own schema. For database connection settings and schema requirements, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/reference/postgresql"},"children":["PostgreSQL configuration"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If database usernames or passwords include reserved URL characters, encode them in connection strings before storing them in secrets."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"example","__idx":7},"children":["Example"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This example shows one possible Keycloak component configuration:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"harmonize:\n  keycloak:\n    admin:\n      name: \"admin\"\n      password: \"\"\n    realmAdmin:\n      name: \"realm-admin\"\n      secret: \"\"\n\ncomponents:\n  keycloak:\n    enabled: true\n    replicas: 2\n    resources:\n      limits:\n        cpu: 1000m\n        memory: 512Mi\n      requests:\n        cpu: 100m\n        memory: 128Mi\n    secrets:\n      psql:\n        secretRef: keycloak-psql\n      kc:\n        secretRef: keycloak-kc\n      oidc-credentials:\n        secretRef: keycloak-oidc-credentials\n      clients:\n        secretRef: keycloak-clients\n    ingress:\n      main:\n        enabled: true\n        hosts:\n          - host: \"openid.example.com\"\n            paths:\n              - path: /\n                pathType: Prefix\n        tls:\n          - secretName: keycloak-tls\n            hosts:\n              - openid.example.com\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-topics","__idx":8},"children":["Related topics"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/reference/oauth-server"},"children":["OAuth server configuration"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/sso"},"children":["Federated identity and SSO"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/sso/keycloak-integration"},"children":["Configure OIDC federation in Keycloak"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/reference/auth-secrets"},"children":["Secret management for authentication"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/reference/networking"},"children":["Networking configuration"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/reference/postgresql"},"children":["PostgreSQL configuration"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/governance/genesis/payload-reference"},"children":["Genesis payload reference"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/sso/keycloak-session-limiting"},"children":["Keycloak session limiting"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/sso/keycloak-inactivity-timeout"},"children":["Keycloak inactivity timeout"]}]}]}]},"headings":[{"value":"Keycloak configuration","id":"keycloak-configuration","depth":1},{"value":"What this config controls","id":"what-this-config-controls","depth":2},{"value":"Environment variables","id":"environment-variables","depth":2},{"value":"Component fields","id":"component-fields","depth":2},{"value":"Admin configuration","id":"admin-configuration","depth":2},{"value":"Secrets","id":"secrets","depth":2},{"value":"Database","id":"database","depth":2},{"value":"Example","id":"example","depth":2},{"value":"Related topics","id":"related-topics","depth":2}],"frontmatter":{"seo":{"title":"Keycloak configuration"}},"lastModified":"2026-07-27T10:10:43.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/v1.38/deployment/reference/keycloak","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}