Keycloak configuration

Use this page to understand the main Keycloak configuration fields used by Ripple Custody. The example shows one possible component configuration; your realm setup, identity-provider integration, resource values, hosts, and secrets depend on your deployment.

Keycloak provides identity and access management for Ripple Custody. Deployment configuration controls the Keycloak service, resource values, database connectivity, admin credentials, secret references, and ingress exposure.

OIDC provider federation is configured in Keycloak after deployment. For the federation model and setup steps, see Federated identity and SSO and Configure OIDC federation in Keycloak.

For Keycloak runtime controls configured outside the deployment values, see Keycloak session limiting and Keycloak inactivity timeout.

Database, host, OAuth provider, and integration URLs are managed by the deployment configuration and should not be set manually unless your release explicitly exposes those fields.

Location: components.keycloak

Resource values are workload-dependent. Set them based on your expected authentication load and observed runtime behavior.

Location: harmonize.keycloak

Keycloak admin credentials and database credentials are supplied through Kubernetes secrets. For the expected secret names and keys, see Secret management for authentication.

Keycloak stores some realm and client configuration in its database. When rotating a client secret or identity-provider secret, update the value where Keycloak stores it and verify any Kubernetes secret consumed by dependent components. Updating only one side can leave the deployment with mismatched secrets.

Keycloak and OAuth use PostgreSQL for persistent storage. Each component uses its own schema. For database connection settings and schema requirements, see PostgreSQL configuration.

If database usernames or passwords include reserved URL characters, encode them in connection strings before storing them in secrets.

This example shows one possible Keycloak component configuration:

harmonize:
  keycloak:
    admin:
      name: "admin"
      password: ""
    realmAdmin:
      name: "realm-admin"
      secret: ""

components:
  keycloak:
    enabled: true
    replicas: 2
    resources:
      limits:
        cpu: 1000m
        memory: 512Mi
      requests:
        cpu: 100m
        memory: 128Mi
    secrets:
      psql:
        secretRef: keycloak-psql
      kc:
        secretRef: keycloak-kc
      oidc-credentials:
        secretRef: keycloak-oidc-credentials
      clients:
        secretRef: keycloak-clients
    ingress:
      main:
        enabled: true
        hosts:
          - host: "openid.example.com"
            paths:
              - path: /
                pathType: Prefix
        tls:
          - secretName: keycloak-tls
            hosts:
              - openid.example.com

• OAuth server configuration
• Federated identity and SSO
• Configure OIDC federation in Keycloak
• Secret management for authentication
• Networking configuration
• PostgreSQL configuration
• Genesis payload reference
• Keycloak session limiting
• Keycloak inactivity timeout