----- Original Message ----- Is the plan eventually to deploy Keycloak as an extension instead of a WAR? I reckon that would solve a fair amount of issues. Could even go as far as creating KeycloakDS with a persistent H2 db from within the subsystem if it's not available? What about defining a boostrap-realm.json file. We already have mechanisms in place for importing a file at startup, which is only imported if the realm doesn't already exist. Would be cool if you had an option to automatically create Keycloak subsystem definitions for apps as they're creating in KC. Could have some sort of co-located option or something.

Hi Stan, Sorry for late reply, got lost in my todo list. ----- Original Message ----- If Keycloak is an extension rather than a WAR would we not be able to have all the modules there ready to go. Then there could be a simple one click button (maybe even in the WF console itself) to enable Keycloak, which would use DMR to enable the extension and also create the required datasource for KC. It should also make it easier to update Keycloak as we could leverage the patching mechanism in WF right? Our configuration mechanism (keycloak-server.json) is pluggable enough so that we could even make it possible to configure it through standalone.xml instead. Also, maybe we could leverage domains to manage a cluster of Keycloak nodes to make sure they all have the same config. At the moment you can either to it with a system property keycloak.import or servlet context-param keycloak.import.realm.resources to specify a json file with the contents of the realm and applications. AeroGear guys use this to bootstrap their realm: https://github.com/aerogear/aerogear-unifiedpush-server/blob/master/serve... Haven't tested this, but I believe it'll be done before the WAR is marked as deployed. It generates new keys for the realm, but not for applications, but that's something we could add easily enough. Also I think it would be worth to make sure it only runs on the first time, at the moment it just checks to see if the realm is there. Would also be nice to be able to add some bootstrapping to the master realm as well with this mechanism (which obviously wouldn't work ATM due to it would just see the master realm and ignore it) Sounds great, but will we ever be able to achieve an integrated UI at this level? A simpler solution may be to deploy a WAR in the standard way to WF. Then to go to a Keycloak WildFly extension UI to do the other steps you listed above.