SecureAnyCloud
Deployment guide

Keycloak 26

Overview

Keycloak is an open-source Identity and Access Management platform. It provides single sign-on (SSO), OAuth 2 / OpenID Connect, SAML 2.0, social login, multi-factor authentication and fine-grained authorization.

This SecureAnyCloud image installs Keycloak 26.6 (Quarkus distribution) from the official GitHub release tarball, alongside OpenJDK 21. At first boot, per-VM SecureAnyCloud admin credentials are bootstrapped with kc.sh bootstrap-admin user.

What you get:

  • Keycloak 26.6.x from the official GitHub release tarball at /opt/keycloak
  • OpenJDK 21 JRE (headless) from Ubuntu 24.04 noble universe
  • kc.sh build pre-compiled (Quarkus AOT) for fast startup
  • keycloak.service running as keycloak:keycloak
  • An HTTP listener on TCP 8080, with the admin console at /admin/master/console/
  • keycloak-firstboot.service, which rotates the SecureAnyCloud admin password with kc.sh bootstrap-admin user
  • An H2 file database at /opt/keycloak/data/h2, suited to single-VM dev and test scale
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key, and a VNet with a subnet.

Standard_B2s (4 GB RAM) is suitable for dev and test or small SSO deployments. For production, switch to a PostgreSQL backend (set KC_DB=postgres and KC_DB_URL) and move to D4s or D8s for larger user populations.

Step 1-3 - Deploy and connect over SSH

Deploy the image from the Azure Marketplace or the Azure CLI, then connect to the VM as azureuser.

ssh azureuser@<vm-ip>
4

Check the service status and version

Confirm that the Keycloak service is running and print its version.

sudo systemctl status keycloak --no-pager | head -10 sudo /opt/keycloak/bin/kc.sh --version
5

Check OIDC discovery

Request the OpenID Connect discovery document for the master realm.

curl -sf http://127.0.0.1:8080/realms/master/.well-known/openid-configuration | head -c 400
6

Read the admin password

Print the credentials file.

sudo cat /stage/scripts/keycloak-credentials.log

Note the values of KEYCLOAK_ADMIN_PASSWORD and KEYCLOAK_ADMIN_URL.

7

Open the welcome page

Browse to http://<vm-ip>:8080/. The Keycloak welcome screen links to the admin console and the documentation.

8

Sign in as admin

Select "Administration Console", or browse to /admin/master/console/, to reach the login form.

9

Explore the admin console

After you sign in as SecureAnyCloud, you reach the master realm admin console. From here you manage realms, clients, users, groups, identity providers and more.

10

Manage users

Open the Users page to see the SecureAnyCloud admin user. From here you can add more master-realm administrators.

11

Know where components live

These are the key paths on the VM.

Keycloak install: /opt/keycloak/

kc.sh CLI: /opt/keycloak/bin/kc.sh

systemd unit: /etc/systemd/system/keycloak.service

Runtime environment file: /etc/keycloak/keycloak.env

H2 database: /opt/keycloak/data/h2/

Logs: /opt/keycloak/data/log/ (and journalctl -u keycloak)

First-boot script: /usr/local/sbin/keycloak-firstboot.sh

Credentials: /stage/scripts/keycloak-credentials.log (mode 0600 root:root)

12

Harden for production

  • Switch from H2 to PostgreSQL. Edit /etc/keycloak/keycloak.env to add KC_DB=postgres KC_DB_URL=jdbc:postgresql://..., then restart.
  • Switch from start-dev to start --hostname=<your-fqdn> --proxy-headers=xforwarded by editing the systemd ExecStart.
  • Enable HTTPS. Provision a real certificate and use the KC_HTTPS_* environment variables.
  • Configure email. In the master realm, open Realm Settings, then Email.
  • Restrict the NSG. Open port 8080 only to your CDN or load balancer, and keep port 22 limited to your management CIDR.
  • Patch monthly. Run apt-get update && apt-get upgrade && reboot, and subscribe to https://www.keycloak.org/news.html for Keycloak releases.

Licensing

Keycloak is licensed under Apache 2.0 and is free to use commercially. SecureAnyCloud provides commercial support separately. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Keycloak 26 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure