keycloak-scim/topics/openshift.adoc

[[_openshift]]

== Running Keycloak Server on OpenShift

Keycloak provides a OpenShift cartridge to make it easy to get it running on OpenShift.
If you don't already have an account or don't know how to create applications go to https://www.openshift.com/        first.
You can create the Keycloak instance either with the web tool or the command line tool, both approaches are described below. 

WARNING: It's important that immediately after creating a Keycloak instance you open the `Administration Console`            and login to reset the password.
If this is not done anyone can easily gain admin rights to your Keycloak instance. 

=== Create Keycloak instance with the web tool

. Open https://openshift.redhat.com/app/console/applications and click on `Add Application`.
. Scroll down to the bottom of the page to find the `Code Anything` section.
. Insert `http://cartreflect-claytondev.rhcloud.com/github/keycloak/openshift-keycloak-cartridge` into the `URL to a cartridge definition` field and click on `Next`.
. Fill in the following form and click on `Create Application`. 
. Click on `Continue to the application overview page`.
. Under the list of applications you should find your Keycloak instance and the status should be `Started`.
. Click on it to open the Keycloak servers homepage. 

=== Create Keycloak instance with the command-line tool

. Run the following command from a terminal: 

[source]
----
rhc app create <APPLICATION NAME> http://cartreflect-claytondev.rhcloud.com/github/keycloak/openshift-keycloak-cartridge
----	
            
. Replace `<APPLICATION NAME>` with the name you want (for example keycloak). 

Once the instance is created the rhc tool outputs details about it.
Open the returned `URL` in a browser to open the Keycloak servers homepage. 

=== Next steps

The Keycloak servers homepage shows the Keycloak logo and `Welcome to Keycloak`.
There is also a link to the `Administration Console`.
Open that and log in using username `admin` and password `admin`.
On the first login you are required to change the password. 

TIP: On OpenShift Keycloak has been configured to only accept requests over https.
If you try to use http you will be redirected to https.