Access structure
Several Keycloak concepts govern user management:- Realm. The realm is the security boundary that holds the appliance’s users, credentials, roles, and groups. Each appliance has its own realm, and its name is provided with the appliance. The correct realm must be confirmed before changes are made.
- Roles. Roles are the permissions used for access control. The appliance ships with its roles created and assigned. These roles must not be altered.
- Groups. Groups assign roles to users. Adding a user to a group grants that group’s access, so grouping is the mechanism for setting what a user can do.
Analysts
Access to the analysis and investigation tools and the ability to view and query collected data. Analysts do not hold system configuration or administrative privileges.
Administrators
Full access to all applications, including application management in Rancher, system configuration, and user management in Keycloak.
In normal operation, the only user-management actions required are creating users and assigning them to the Analyst or Administrator group. The roles behind those groups are already configured.
Adding a user
1
Open the Keycloak Admin Console
Open Keycloak in a web browser and sign in with an account authorized to manage users. Confirm the correct realm for the appliance is selected.
2
Create the account
Navigate to Users and select Add user. Enter a unique username. First and last name are optional and used for display only. Do not configure email-based verification or rely on email for activation or recovery. Save the account.
3
Set an initial password
Open the user’s Credentials section and set an initial password. Mark it as temporary so the user is required to change it at first sign-in.
4
Assign a group
Open the user’s Groups tab and add the user to the appropriate group (Analyst or Administrator). Save, and confirm the expected access appears for the user.
5
Confirm first sign-in
The user signs in and is prompted to set a new password before reaching any application, after which the same credentials apply across all applications.
Offboarding a user
A user is offboarded as soon as access is no longer required. The preferred action is to disable the account rather than delete it: this immediately blocks sign-in while preserving the account record for audit and review.1
Open the Keycloak Admin Console
Sign in with an administrative account and confirm the correct realm is selected.
2
Locate the user
Navigate to Users, search for the account, and open it. Confirm it is the correct account before making changes.
3
Disable the account
Set the account to disabled using the Enabled toggle. This prevents future sign-ins and is the standard offboarding action.
4
End active sessions
Terminate the user’s active sessions so the user is signed out of any currently authenticated applications. Keycloak can log the user out across all connected applications.
5
Review access
Review the user’s assigned access and remove anything no longer appropriate. Save, and confirm the account is disabled.
Disabling is the recommended default, as it blocks access without permanently removing the record. Permanent deletion may be appropriate in certain cases, subject to the operating organization’s retention and audit requirements.