wget https://github.com/keycloak/keycloak/releases/download/20.0.3/keycloak-20.0.3.tar.gz -O /tmp/keycloak-20.0.3.tar.gz
sudo tar -zxvf /tmp/keycloak-20.0.3.tar.gz -C /opt/
sudo mv /opt/keycloak-20.0.3/ /opt/keycloak
sudo groupadd keycloak 
sudo useradd -r -g keycloak -d /opt/keycloak -s /sbin/nologin keycloak 
## Keycloak permissions 
sudo chown -R keycloak:keycloak /opt/keycloak 
sudo chmod -R o+rwx /opt/keycloak

# update /opt/keycloak/conf/keycloak.conf as keycloak user
keycloak@idp:~$ ./bin/kc.sh build
keycloak@idp:~$ export KEYCLOAK_ADMIN=admin
keycloak@idp:~$ export KEYCLOAK_ADMIN_PASSWORD=XXXX
keycloak@idp:~$ ./bin/kc.sh

cat <<EOF | sudo tee -a /etc/systemd/system/keycloak.service
[Unit]
Description=Keycloak Application Server
After=syslog.target network.target

[Service]
Type=simple
TimeoutStopSec=0
Restart=on-failure
RestartSec=2s
KillSignal=SIGTERM
KillMode=process
SuccessExitStatus=143
LimitMEMLOCK=infinity
SendSIGKILL=no
WorkingDirectory=/opt/keycloak/
User=keycloak
Group=keycloak
LimitNOFILE=102642
# Default user
Environment=KEYCLOAK_ADMIN=admin
Environment=KEYCLOAK_ADMIN_PASSWORD=XXXX
# Database
Environment=KC_DB=postgres
Environment=KC_DB_PASSWORD=XXXX
Environment=KC_DB_USERNAME=keycloak
Environment=KC_DB_URL=jdbc:postgresql://localhost/keycloak
# Proxy
Environment=KC_PROXY=edge
Environment=KC_HOSTNAME_STRICT=false
ExecStart=/opt/keycloak/bin/kc.sh start --optimized

[Install]
WantedBy=multi-user.target
EOF

sudo apt install postgresql postgresql-contrib -y

sudo -u postgres psql -c "CREATE USER keycloak WITH PASSWORD 'changeme-postgres';"
sudo -u postgres psql -c "CREATE DATABASE keycloak OWNER keycloak;"
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;"

# keycloak configuration
./bin/kc.sh start --db postgres --db-url-host localhost --db-username keycloak --db-password changeme-postgres
kc.sh start --optimized --db-url-host=localhost --db-username=keycloak --db-password=*******

# sysctcl
root@idp:/etc/sysctl.d# cat 98-keycloak.conf
net.core.wmem_max=26214400
net.core.rmem_max=26214400 

bin/standalone.sh -Dkeycloak.migration.action=export -Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=${REALMNAME}-keycloak-export.json -Djboss.http.port=8888 -Djboss.https.port=9999 -Djboss.management.http.port=7777 [-Dkeycloak.migration.realmName=${REALMNAME}]

bin/standalone.sh -Dkeycloak.migration.action=export -Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=all-realms-keycloak-export.json -Djboss.http.port=8888 -Djboss.https.port=9999 -Djboss.management.http.port=7777`

"config" : {
        "pagination" : [ "true" ],
        "fullSyncPeriod" : [ "-1" ],
        "usersDn" : [ "cn=users,cn=accounts,dc=mylabserver,dc=com" ],
        "connectionPooling" : [ "true" ],
        "cachePolicy" : [ "DEFAULT" ],
        "useKerberosForPasswordAuthentication" : [ "false" ],
        "importEnabled" : [ "true" ],
        "enabled" : [ "true" ],
        "bindCredential" : [ "mrxQm1Wo6eu1bxAhAJ7rreMJ" ],
        "changedSyncPeriod" : [ "-1" ],
        "usernameLDAPAttribute" : [ "uid" ],
        "bindDn" : [ "uid=vault,cn=users,cn=accounts,dc=mylabserver,dc=com" ],
        "lastSync" : [ "1585833916" ],
        "vendor" : [ "other" ],
        "uuidLDAPAttribute" : [ "uid" ],
        "allowKerberosAuthentication" : [ "false" ],
        "connectionUrl" : [ "ldap://172.31.28.49:389" ],
        "syncRegistrations" : [ "false" ],
        "authType" : [ "simple" ],
        "customUserSearchFilter" : [ "(uid=*)" ],
        "debug" : [ "false" ],
        "searchScope" : [ "2" ],
        "useTruststoreSpi" : [ "ldapsOnly" ],
        "priority" : [ "0" ],
        "trustEmail" : [ "false" ],
        "userObjectClasses" : [ "inetorgperson" ],
        "rdnLDAPAttribute" : [ "uid" ],
        "editMode" : [ "READ_ONLY" ],
        "validatePasswordPolicy" : [ "false" ],
        "batchSizeForSync" : [ "1000" ]
      }

### group mapping
https://www.janua.fr/mapping-ldap-group-and-roles-to-redhat-sso-keycloak/
{
          "id" : "45c0f95c-d834-4904-aeac-886957b09d3d",
          "name" : "ldap-group-mapping",
          "providerId" : "group-ldap-mapper",
          "subComponents" : { },
          "config" : {
            "membership.attribute.type" : [ "DN" ],
            "group.name.ldap.attribute" : [ "cn" ],
            "membership.user.ldap.attribute" : [ "uid" ],
            "preserve.group.inheritance" : [ "true" ],
            "groups.dn" : [ "cn=groups,cn=accounts,dc=mylabserver,dc=com" ],
            "mode" : [ "READ_ONLY" ],
            "user.roles.retrieve.strategy" : [ "LOAD_GROUPS_BY_MEMBER_ATTRIBUTE" ],
            "groups.ldap.filter" : [ "(objectclass=ipausergroup)" ],
            "ignore.missing.groups" : [ "false" ],
            "membership.ldap.attribute" : [ "member" ],
            "group.object.classes" : [ "groupOfNames" ],
            "memberof.ldap.attribute" : [ "memberOf" ],
            "drop.non.existing.groups.during.sync" : [ "false" ]
          }

{
          "id" : "57e9dc44-3b46-47f2-8b62-8bc95e03fb40",
          "name" : "ldap-role-mapping",
          "providerId" : "role-ldap-mapper",
          "subComponents" : { },
          "config" : {
            "mode" : [ "READ_ONLY" ],
            "membership.attribute.type" : [ "DN" ],
            "roles.dn" : [ "cn=roles,cn=accounts,dc=computingforgeeks,dc=com" ],
            "user.roles.retrieve.strategy" : [ "GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE" ],
            "membership.user.ldap.attribute" : [ "uid" ],
            "membership.ldap.attribute" : [ "member" ],
            "memberof.ldap.attribute" : [ "memberOf" ],
            "role.name.ldap.attribute" : [ "cn" ],
            "use.realm.roles.mapping" : [ "true" ],
            "roles.ldap.filter" : [ "(objectClass=groupOfNames)" ],
            "role.object.classes" : [ "groupOfNames" ]
          }

curl -s -X POST -k -d "scope=openid" \
-d "username=${USERNAME}" \
-d "password=${PASSWORD}" \
-d "grant_type=password" \
-d "client_id=${CLIENT_ID}" \
-d "client_secret=${CLIENT_SECRET}" \
http://${KEYCLOAK_HOST}:8080/auth/realms/${REALM}/protocol/openid-connect/token | jq '.access_token' | sed 's/[^.]*.\([^.]*\).*/\1/' | base64 -d | jq

{
  "exp": 1586444033,
  "iat": 1586443733,
  "jti": "88e1b10d-15b4-41a9-bd69-45ea55aec3de",
  "iss": "http://localhost:8080/auth/realms/computingforgeeks.com",
  "aud": "account",
  "sub": "8b505d1f-82e5-4e8c-8a77-ddf48a9af7ad",
  "typ": "Bearer",
  "azp": "grafana",
  "session_state": "e30ad572-af9e-4aad-942c-a23ae3004b13",
  "acr": "1",
  "allowed-origins": [
    ""
  ],
  "realm_access": {
    "roles": [
      "offline_access",
      "new_admins",
      "uma_authorization"
    ]
  },
  "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "openid email profile",
  "email_verified": false,
  "role": [
    "offline_access",
    "new_admins",
    "uma_authorization"
  ],
  "name": "new_admin new_admin new_admin",
  "preferred_username": "new_admin",
  "given_name": "new_admin new_admin",
  "family_name": "new_admin",
  "email": "[email protected]",
  "group": [
    "/ipausers",
    "/new_admins"
  ]
}

docker run -d -p 18080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:latest start-dev

keycloak:
    image: keycloak-mybuild:20.0.3
    restart: on-failure:5
    container_name: keycloak
    command: start --optimized 
    ports:
      - "8080"
    environment:
      - KC_DB=postgres
      - KC_DB_URL=jdbc:postgresql://postgres:5432/xxxxxxxx
      - KC_DB_USERNAME=xxxxxxxx
      - KC_DB_PASSWORD=xxxxxxxx
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=xxxxxxxx
      - KC_HOSTNAME_STRICT=false
      - KC_HOSTNAME_STRICT_HTTPS=false
      - PROXY_ADDRESS_FORWARDING=true
      - KC_HTTP_RELATIVE_PATH=/auth
      - KC_HTTP_ENABLED=true
      - KC_HTTP_PORT=8080
      - JAVA_OPTS_APPEND="-Dcom.redhat.fips=false"
    depends_on:
      - postgres
    networks:
      - namednetwork

helm repo add bitnami https://charts.bitnami.com/bitnami
helm install keycloak bitnami/keycloak --set volumePermissions.enabled=true

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-postgres
spec:
  capacity:
    storage: 8Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Recycle
  hostPath:
    path: /data