Manage Realms

A Realm is the primary isolation unit in Keycloak. Each Realm has independent users, clients, roles, and authentication configuration. Alauda Application Services Identity Management E1 supports managing Realms both through the Admin Console and declaratively via the KeycloakRealmImport CRD.

Import a Realm via CRD

The KeycloakRealmImport CRD enables declarative Realm provisioning. When you create a KeycloakRealmImport resource, the Operator triggers a one-time import Job that loads the Realm configuration into the target Keycloak instance.

One-Time Import

The KeycloakRealmImport performs a one-time import at creation, not continuous synchronization. Changes made via the Admin Console after import are not reflected back to the CR. For ongoing Realm configuration changes, use the Admin Console or Admin REST API.

Procedure

CLI

Web Console

Create a KeycloakRealmImport resource:

apiVersion: k8s.keycloak.org/v2alpha1
kind: KeycloakRealmImport
metadata:
  name: my-realm-import
spec:
  keycloakCRName: example-kc
  realm:
    realm: my-realm
    enabled: true
    displayName: "My Application Realm"
    registrationAllowed: false
    loginWithEmailAllowed: true
    duplicateEmailsAllowed: false
    sslRequired: external
    accessTokenLifespan: 300
    clients:
      - clientId: my-app
        enabled: true
        publicClient: true
        redirectUris:
          - "https://my-app.example.com/*"
        webOrigins:
          - "https://my-app.example.com"

Apply the manifest:

kubectl apply -f realm-import.yaml -n <namespace>

Check the import status:

kubectl get keycloakrealmimport my-realm-import -n <namespace> \
  -o jsonpath='{.status.conditions[?(@.type=="Done")].status}'

When the output is True, the Realm has been imported successfully.

Using Placeholders for Secrets

The spec.placeholders field allows you to inject Secret values into the Realm configuration at import time, avoiding hardcoded credentials in the CR:

spec:
  keycloakCRName: example-kc
  placeholders:
    CLIENT_SECRET:
      secret:
        name: my-client-secret
        key: client-secret
  realm:
    clients:
      - clientId: my-app
        secret: $(CLIENT_SECRET)

Manage Realm Settings via Admin Console

Access Realm Settings

Log in to the Keycloak Admin Console.
Select the target Realm from the top-left dropdown.
Click Realm Settings in the left navigation bar.

Key Realm Settings

Setting	Description
Display Name	The human-readable name shown on the login page
SSL Required	Controls when HTTPS is required. Options: `none`, `external` (recommended), `all`
Login Settings	Controls user self-registration, email login, and email uniqueness enforcement
Token Settings	Configures access token lifespan, refresh token lifespan, and SSO session timeouts
Email Settings	SMTP server configuration for sending verification and notification emails
Themes	Customizes the login, account, admin, and email templates

Configure Token Lifespans

Token lifespans control how long issued tokens remain valid. Shorter lifespans improve security but require more frequent token refresh operations.

Token	Default	Recommended (Production)
Access Token Lifespan	300 seconds	60–300 seconds
SSO Session Idle	1800 seconds	1800 seconds
SSO Session Max	36000 seconds	36000 seconds
Refresh Token Lifespan	Session-bound	Session-bound

#Manage Realms

#TOC

#Import a Realm via CRD

#Procedure

#Using Placeholders for Secrets

#Manage Realm Settings via Admin Console

#Access Realm Settings

#Key Realm Settings

#Configure Token Lifespans