Keycloak

Keycloak

Identity and access management for login, roles, and SSO.

Overview

Keycloak provides centralized authentication and authorization for the SensorHub platform:

  • User authentication and management
  • Role-based access control (RBAC)
  • Single Sign-On (SSO)
  • OAuth2 and OpenID Connect support
  • Integration with other services via OIDC

Technology Stack

  • Keycloak 23.0.6 (container image: quay.io/keycloak/keycloak)
  • PostgreSQL for realm database
  • Docker containerization
  • HTTPS with SSL certificates

Architecture

┌─────────────┐
│  Frontend   │
└──────┬──────┘
       │ (OIDC/OAuth)
       ▼
┌──────────────────┐
│    Keycloak      │
└──────┬───────────┘
       │ (DB)
       ▼
   PostgreSQL

Configuration

Environment Variables

KC_DB: postgres
KC_DB_URL_HOST: postgres
KC_DB_URL_DATABASE: keycloak
KC_DB_USERNAME: keycloak
KC_DB_PASSWORD: [password]
KC_HOSTNAME_URL: https://keycloak-dev.hef.tum.de
KC_HOSTNAME_STRICT_HTTPS: "true"
KC_PROXY: edge
KEYCLOAK_ADMIN: admin
KEYCLOAK_ADMIN_PASSWORD: [password]

SSL/TLS

SSL certificates mounted from:

/etc/letsencrypt/live/keycloak-dev.hef.tum.de/

Realm Configuration

Realms

  • sensorhub-dev: Development realm for the SensorHub platform

Clients

Service clients configured for:

  • Frontend (public client for SPA)
  • Backend (confidential client for API)
  • Grafana (for monitoring dashboard authentication)
  • Other services requiring OIDC/OAuth integration

Roles

  • sensorhub-admin: Full platform administration
  • sensorhub-user: Standard user access
  • sensorhub-viewer: Read-only access
  • sensorhub-grafana-admin: Grafana administration

Security

  • HTTPS-only communication
  • Strict hostname validation
  • Strong password requirements
  • Session management
  • Token expiration policies

Integration Points

  • Frontend: OIDC redirect flow for user login
  • Backend: API token validation
  • Grafana: OAuth2 delegated authentication
  • Services: Token-based API authentication

Management

Admin Console

Access via: https://keycloak-dev.hef.tum.de/auth/admin

User Management

  • User creation and provisioning
  • Password policies
  • Multi-factor authentication (if configured)
  • User federation

References

FrontendMonitoring Stack