> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-muhammad-kumail-github-mcp-tab.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Set up a Keycloak connector
> C1 provides identity governance and just-in-time provisioning for Keycloak. Integrate your Keycloak instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.
## Availability
This connector works with Keycloak servers that expose the Admin REST API (tested against Keycloak 26). Nested-group (sub-group) sync requires Keycloak 23 or later.
## Capabilities
| Resource | Sync | Provision |
| :------- | :------------------------------------------------------------ | :------------------------------------------------------------ |
| Accounts | | |
| Groups | | |
The Keycloak connector syncs the following resources:
* **Accounts**: Keycloak realm users with username, email, name, login, and enabled status. Supports [automatic account creation](/product/admin/account-provisioning) when a user requests access but does not yet exist in the realm, reversible enable/disable via connector actions, and permanent deletion.
* **Groups**: Keycloak groups with a static `member` entitlement. Grant and revoke add or remove users from a group. Enable **Sync sub-groups** to sync nested group hierarchies; parent groups inherit membership from child groups during sync.
**Additional functionality:**
The Keycloak connector supports [automatic account provisioning](/product/admin/account-provisioning). New accounts can receive a generated password (**Random password**, preferred) or be created without a password so the user sets one at first login (**No password**). Accounts can be disabled (soft, reversible) or enabled again through connector actions, and permanently removed through deletion.
### Connector actions
Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the [Perform connector action](/product/admin/automations-steps-reference#perform-connector-action) automation step.
| Action name | Additional fields | Description |
| -------------- | -------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `enable_user` | `user_id` (string, required) | Reactivates a Keycloak user (sets `enabled=true`). |
| `disable_user` | `user_id` (string, required) | Deactivates a Keycloak user (sets `enabled=false`); reversible. |
| `update_user` | `user_id` (string, required), `user_profile` (JSON string, required) | Updates a Keycloak user's profile attributes (`email`, `firstName`, `lastName`). |
## Gather Keycloak credentials
Configuring the connector requires credentials generated in the Keycloak Admin Console. Gather these credentials before you move on.
A Keycloak realm administrator who can create confidential clients and assign
**realm-management** client roles to service accounts must perform this task.
### Create a Keycloak client
In the Keycloak Admin Console, navigate to **Clients**.
Make sure you are in the correct realm, then click **Create client**.
Choose a **Client ID** for the client. Save this ID for connector setup.
Fill out the client registration form. Enable **Client authentication** (confidential client).
Save the client configuration.
On the client **Credentials** tab, copy and save the **Client secret**.
On the client **Settings** tab, enable **Service accounts roles**.
Open the client **Service account roles** tab.
Click **Assign role**, filter by **Client roles**, and select the **realm-management** client (in the **master** realm this client is named **master-realm**).
Assign these client roles to the service account:
* `manage-users` — required to create users and grant or revoke group membership
* `view-users` — required to sync users and read back created accounts
* `query-users` — required to list and search users during sync
* `query-groups` — required to list groups during sync
Note your Keycloak **server URL** and **realm** name for connector configuration.
A **403 Forbidden** response when creating users means the service account is
missing the `manage-users` role. This is a realm configuration issue, not a
connector defect.
For more information, see the [Keycloak Server Administration Guide](https://www.keycloak.org/docs/latest/server_admin/).
**Done.** Next, move on to the connector configuration instructions.
## Configure the Keycloak connector
To complete this task, you need:
* The **Connector Administrator** or **Super Administrator** role in C1
* The Keycloak credentials generated by following the instructions above
**Follow these instructions to use a built-in, no-code connector hosted by C1.**
In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
Search for **Keycloak** and click **Add**.
Choose how to set up the new Keycloak connector:
* Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that are not yet managed with C1)
* Add the connector to a managed app (select from the list of existing managed apps)
* Create a new managed app
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.
If you choose someone else, C1 notifies the new connector owner by email that their help is needed to complete the setup process.
Click **Next**.
Find the **Settings** area of the page and click **Edit**.
Paste the Keycloak credentials into the relevant fields:
* **keycloak-server-url** (required): The URL of the Keycloak server
* **keycloak-realm** (required): The realm of the Keycloak server
* **keycloak-client-id** (required): The client ID you made
* **keycloak-client-secret** (required): The client secret for the client you made
* **sync-sub-groups**: Enable syncing of nested group hierarchies (subgroups)
Click **Save**.
The connector label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
**Done.** Your Keycloak connector is now pulling access data into C1.
**Follow these instructions to use the Keycloak connector, hosted and run in your own environment.**
When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.
### Resources
* [Official download center](https://dist.conductorone.com/ConductorOne/baton-keycloak): For stable binaries (Windows/Linux/macOS) and container images.
* [GitHub repository](https://github.com/conductorone/baton-keycloak): Access the source code, report issues, or contribute to the project.
### Step 1: Set up a new Keycloak connector
In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
Search for **Baton** and click **Add**.
Choose how to set up the new Keycloak connector:
* Add the connector to a currently unmanaged app
* Add the connector to a managed app
* Create a new managed app
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.
If you choose someone else, C1 notifies the new connector owner by email that their help is needed to complete the setup process.
Click **Next**.
In the **Settings** area of the page, click **Edit**.
Click **Rotate** to generate a new Client ID and Secret.
Carefully copy and save these credentials. You use them in Step 2.
### Step 2: Create Kubernetes configuration files
Create two Kubernetes manifest files for your Keycloak connector deployment:
#### Secrets configuration
```yaml expandable theme={null}
# baton-keycloak-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
name: baton-keycloak-secrets
type: Opaque
stringData:
# C1 credentials
BATON_CLIENT_ID:
BATON_CLIENT_SECRET:
# Keycloak credentials
BATON_KEYCLOAK_CLIENT_ID:
BATON_KEYCLOAK_CLIENT_SECRET:
BATON_KEYCLOAK_REALM:
BATON_KEYCLOAK_SERVER_URL:
# Optional: include if you want C1 to provision access using this connector
BATON_PROVISIONING: true
# Optional: sync nested group hierarchies (subgroups)
BATON_SYNC_SUB_GROUPS: true
```
**Syncing subgroups**: Set `BATON_SYNC_SUB_GROUPS` to `true` to sync nested
Keycloak group hierarchies. When enabled, subgroup membership relationships
are surfaced in C1, and grant and revoke operations are supported for nested
groups.
See the connector [README](https://github.com/conductorone/baton-keycloak) or run `--help` for all configuration flags and environment variables.
#### Deployment configuration
```yaml expandable theme={null}
# baton-keycloak.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: baton-keycloak
labels:
app: baton-keycloak
spec:
selector:
matchLabels:
app: baton-keycloak
template:
metadata:
labels:
app: baton-keycloak
baton: true
baton-app: keycloak
spec:
containers:
- name: baton-keycloak
image: public.ecr.aws/conductorone/baton-keycloak:latest
imagePullPolicy: IfNotPresent
env:
- name: BATON_HOST_ID
value: baton-keycloak
envFrom:
- secretRef:
name: baton-keycloak-secrets
```
### Step 3: Deploy the connector
Create a namespace in which to run C1 connectors (if desired), then apply
the secret config and deployment config files.
Check that the connector data uploaded correctly. In C1, click **Apps**. On
the **Managed apps** tab, locate and click the name of the application you
added the Keycloak connector to. Keycloak data should be found on the
**Entitlements** and **Accounts** tabs.
**Done.** Your Keycloak connector is now pulling access data into C1.