Re: [keycloak-dev] Aerogear UPS + External Keycloak boostrap

More thoughts on this: Can the Aerogear Openshift cartridge be based on Wildfly? There's some general issues/problems/road blocks we have: * Wildfly REST mgmt api requires port mappings on Openshift * Wildfly Mgmt API requires the setup of an admin user. Not sure how easily this can be done for Openshift deployments. * Both of the above are extra steps the user has to do which make the user experience much more complicated and require a lot of knowledge about Wildfly, etc. * Similarly, Keycloak cannot be preconfigured with a distro as it requires unique keypairs for digital signatures it uses for token signing. UPS + Keycloak in one bundle: 1. Have Aerogear installed with Keycloak on the same Wildfly instance. 2. The Keycloak adapter will allow for an UNCONFIGURED state. In this state, the adapter is configured and running for the application, but will not allow any connections until the underlying wildfly subsystem for that deployment is set up. 3. Aerogear should have a "Bootstrap Subsystem" that is triggered on launch. It should check to see if security is UNCONFIGURED for the aerogear deployment. If it hasn't, locally it creates the necessary keycloak metadata using keycloak apis to initialize the UPS realm and initial users and locally updates the wildfly subsystem so the Aerogear WAR deployment keycloak adapter becomes aware of configuration. UPS joining an external Keycloak realm: * The Keycloak Adapter will have an optional switch so that its config settings can be changed remotely. It will be secured similarly to how we secure single logout requests. * The Keycloak admin console will have a "Move Application" option. You will specify a URL of the external Keycloak Realm you want to move to. This action will upload application metadata to the remote realm. It will also communicate with the application deployment (the keycloak adapter) to update its settings to point to the new realm. * UPS admin will login to the UPS + Keycloak deployment. He will then use this "Move Application" feature. -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com