Skip to content

Keycloak

Keycloak is the shared SSO dependency for AMS user-facing modules. Deploy and configure it before you expect users to sign in to Command Center, ARE, EOBS, or FortifyOps.

Role in AMS

  • Hosts the identity realm users authenticate against
  • Issues tokens / sessions consumed by AMS frontends and APIs
  • Integrates with your enterprise IdP when you configure identity brokering (optional, customer-specific)

Chart

Use ams-helm-keycloak-application with Azure release values appropriate to your environment.

Deploy outline

  1. Ensure PostgreSQL (or the database Keycloak expects) is reachable from the cluster.
  2. Create the keycloak namespace if needed.
  3. Place admin and DB credentials in Key Vault or Kubernetes Secrets.
  4. Set the public URL Keycloak will advertise (must match what browsers and AMS apps use).
  5. Install:
helm upgrade --install ams-keycloak ./ams-helm-keycloak-application \
  --namespace keycloak \
  --create-namespace \
  -f providers/azure/release/values.yaml

Configuration you must own

Topic Guidance
Realm import / bootstrap Follow your AMS Keycloak realm guide or operator runbook after the pod is Ready
Redirect URIs Include each AMS UI origin / path that performs login
TLS Prefer terminating TLS at Application Gateway; keep internal URLs consistent
Network If AKS is private, Keycloak still needs a reachable hostname for browsers

Verify

  • Keycloak admin console loads on the configured host.
  • A test user can authenticate.
  • AMS module values point at the correct Keycloak URL and client IDs.

External identity providers

Many customers federate Keycloak to Entra ID or another IdP. That federation is outside the Helm chart defaults — configure it in Keycloak after install.