Revise use of Keycloak term

Closes #27953

Signed-off-by: AndyMunro <amunro@redhat.com>
This commit is contained in:
AndyMunro 2024-03-15 14:26:53 -04:00 committed by Alexander Schwartz
parent 28afd77917
commit 0e5d685cd3
10 changed files with 16 additions and 16 deletions

View file

@ -203,7 +203,7 @@ Instead, when you have a distributed cache setup running on AWS EC2 instances, y
Cloud vendor specific stacks have additional dependencies for {project_name}.
For more information and links to repositories with these dependencies, see the https://infinispan.org/docs/dev/titles/embedding/embedding.html#jgroups-cloud-discovery-protocols_cluster-transport[Infinispan documentation].
To provide the dependencies to {project_name}, put the respective JAR in the `providers` directory and build Keycloak by entering this command:
To provide the dependencies to {project_name}, put the respective JAR in the `providers` directory and build {project_name} by entering this command:
<@kc.build parameters="--cache-stack=<ec2|google|azure>"/>

View file

@ -34,7 +34,7 @@ A production environment should protect itself from an overload situation, so th
One way of doing this is rejecting additional requests once a certain threshold is reached.
Load shedding should be implemented on all levels, including the load balancers in your environment.
In addition to that, there is a feature in Keycloak to limit the number of requests that can't be processed right away and need to be queued.
In addition to that, there is a feature in {project_Name} to limit the number of requests that can't be processed right away and need to be queued.
By default, there is no limit set.
Set the option `http-max-queued-requests` to limit the number of queued requests to a given threshold matching your environment.
Any request that exceeds this limit would return with an immediate `503 Server not Available` response.

View file

@ -146,7 +146,7 @@ You can use only a https://github.com/keycloak/keycloak/blob/main/quarkus/runtim
Similarly, you can also store Quarkus properties in a Java KeyStore.
Note that some Quarkus properties are already mapped in the {project_name} configuration, such as `quarkus.http.port` and similar essential properties. If the property is used by Keycloak, defining that property key in `quarkus.properties` has no effect. The Keycloak configuration value takes precedence over the Quarkus property value.
Note that some Quarkus properties are already mapped in the {project_name} configuration, such as `quarkus.http.port` and similar essential properties. If the property is used by {project_Name}, defining that property key in `quarkus.properties` has no effect. The {project_Name} configuration value takes precedence over the Quarkus property value.
=== Using special characters in values

View file

@ -9,7 +9,7 @@ title="Running {project_name} in a container"
summary="Learn how to run {project_name} from a container image"
includedOptions="db db-url db-username db-password features hostname https-key-store-file https-key-store-password health-enabled metrics-enabled">
This {section} describes how to optimize and run the {project_name} container image to provide the best experience running a {project_name} container.
This {section} describes how to optimize and run the {project_name} container image to provide the best experience running a container.
<@profile.ifProduct>
@ -82,7 +82,7 @@ RUN /opt/keycloak/bin/kc.sh build
=== Installing additional RPM packages
If you try to install new software in a stage `+FROM quay.io/keycloak/keycloak+`, you will notice that `+microdnf+`, `+dnf+`, and even `+rpm+` are not installed. Also, very few packages are available, only enough for a `+bash+` shell, and to run Keycloak itself. This is due to security hardening measures, which reduce the attack surface of the Keycloak container.
If you try to install new software in a stage `+FROM quay.io/keycloak/keycloak+`, you will notice that `+microdnf+`, `+dnf+`, and even `+rpm+` are not installed. Also, very few packages are available, only enough for a `+bash+` shell, and to run {project_name} itself. This is due to security hardening measures, which reduce the attack surface of the {project_name} container.
First, consider if your use case can be implemented in a different way, and so avoid installing new RPMs into the final container:
@ -216,7 +216,7 @@ This approach significantly increases startup time and creates an image that is
== Importing A Realm On Startup
The {project_name} containers have a directory `/opt/keycloak/data/import`. If you put one or more import files in that directory via a volume mount or other means and add the startup argument `--import-realm`, the Keycloak container will import that data on startup! This may only make sense to do in Dev mode.
The {project_name} containers have a directory `/opt/keycloak/data/import`. If you put one or more import files in that directory via a volume mount or other means and add the startup argument `--import-realm`, the {project_name} container will import that data on startup! This may only make sense to do in Dev mode.
[source,bash,subs="attributes+"]
----
@ -236,7 +236,7 @@ This behavior is achieved by JVM options `-XX:MaxRAMPercentage=70`, and `-XX:Ini
The `-XX:MaxRAMPercentage` option represents the maximum heap size as 70% of the total container memory.
The `-XX:InitialRAMPercentage` option represents the initial heap size as 50% of the total container memory.
These values were chosen based on a deeper analysis of Keycloak memory management.
These values were chosen based on a deeper analysis of {project_name} memory management.
The JVM options related to the heap might be overridden by setting the environment variable `JAVA_OPTS_KC_HEAP`.
You can find the default values of the `JAVA_OPTS_KC_HEAP` in the source code of the `kc.sh`, or `kc.bat` script.

View file

@ -52,7 +52,7 @@ To install the Oracle Database driver for {project_name}:
. When running the unzipped distribution: Place the `ojdbc11` and `orai18n` JAR files in {project_name}'s `providers` folder
. When running containers: Build a custom {project_name} image and add the JARs in the `providers` folder. When building a custom image for the Keycloak Operator, those images need to be optimized images with all build-time options of Keycloak set.
. When running containers: Build a custom {project_name} image and add the JARs in the `providers` folder. When building a custom image for the Operator, those images need to be optimized images with all build-time options of {project_name} set.
+
A minimal Dockerfile to build an image which can be used with the {project_name} Operator and includes Oracle Database JDBC drivers downloaded from Maven Central looks like the following:
+
@ -258,7 +258,7 @@ See the <@links.server id="containers" /> {section} for details on how to build
Beginning with MySQL 8.0.30, MySQL supports generated invisible primary keys for any InnoDB table that is created without an explicit primary key (more information https://dev.mysql.com/doc/refman/8.0/en/create-table-gipks.html[here]).
If this feature is enabled, the database schema initialization and also migrations will fail with the error message `Multiple primary key defined (1068)`.
You then need to disable it by setting the parameter `sql_generate_invisible_primary_key` to `OFF` in your MySQL server configuration before installing or upgrading Keycloak.
You then need to disable it by setting the parameter `sql_generate_invisible_primary_key` to `OFF` in your MySQL server configuration before installing or upgrading {project_name}.
== Changing database locking timeout in a cluster configuration
@ -269,7 +269,7 @@ The maximum timeout for this lock is 900 seconds. If a node waits on this lock f
<@kc.start parameters="--spi-dblock-jpa-lock-wait-timeout 900"/>
== Using Database Vendors without XA transaction support
{project_name} uses XA transactions and the appropriate database drivers by default. Certain vendors, such as Azure SQL and MariaDB Galera, do not support or rely on the XA transaction mechanism. To use Keycloak without XA transaction support using the appropriate JDBC driver, enter the following command:
{project_name} uses XA transactions and the appropriate database drivers by default. Certain vendors, such as Azure SQL and MariaDB Galera, do not support or rely on the XA transaction mechanism. To use {project_name} without XA transaction support using the appropriate JDBC driver, enter the following command:
<@kc.build parameters="--db=<vendor> --transaction-xa-enabled=false"/>

View file

@ -38,7 +38,7 @@ When {project_name} executes in fips mode, it will use the BCFIPS bits instead o
=== BouncyCastle FIPS bits
BouncyCastle FIPS can be downloaded from the https://www.bouncycastle.org/fips-java/[BouncyCastle official page]. Then you can add them to the directory
`KEYCLOAK_HOME/providers` of your distribution. Make sure to use proper versions compatible with BouncyCastle Keycloak dependencies. The supported BCFIPS bits needed are:
`KEYCLOAK_HOME/providers` of your distribution. Make sure to use proper versions compatible with BouncyCastle {project_name} dependencies. The supported BCFIPS bits needed are:
* `bc-fips-1.0.2.3.jar`
* `bctls-fips-1.0.18.jar`
@ -271,6 +271,6 @@ If you are still restricted to running {project_name} on such a system, you can
at least the setup is closer to it. It can be done by providing a custom security file with only an overriden list of security providers as described earlier. For a list of recommended providers,
see the https://access.redhat.com/documentation/en-us/openjdk/17/html/configuring_openjdk_17_on_rhel_with_fips/openjdk-default-fips-configuration[OpenJDK 17 documentation].
You can check the {project_name} server log at startup to see if the correct security providers are used. TRACE logging should be enabled for crypto-related Keycloak packages as described in the Keycloak startup command earlier.
You can check the {project_name} server log at startup to see if the correct security providers are used. TRACE logging should be enabled for crypto-related {project_name} packages as described in the Keycloak startup command earlier.
</@tmpl.guide>

View file

@ -8,7 +8,7 @@ title="Enabling {project_name} Health checks"
summary="Learn how to enable and use {project_name} health checks"
includedOptions="health-enabled">
{project_name} has built in support for health checks. This {section} describes how to enable and use the Keycloak health checks.
{project_name} has built in support for health checks. This {section} describes how to enable and use the {project_name} health checks.
== {project_name} health check endpoints

View file

@ -25,7 +25,7 @@ Use the `--help` command line option for each command to see the available optio
Some of the configuration options are build time configuration options.
As default, {project_name} will re-build automatically for the `export` and `import` commands if it detects a change of a build time parameter.
If you have built an optimized version of {project_name} with the `build` command as outlined in <@links.server id="configuration"/>, use the command line option `--optimized` to have Keycloak skip the build check for a faster startup time.
If you have built an optimized version of {project_name} with the `build` command as outlined in <@links.server id="configuration"/>, use the command line option `--optimized` to have {project_name} skip the build check for a faster startup time.
When doing this, remove the build time options from the command line and keep only the runtime options.
== Exporting a Realm to a Directory

View file

@ -8,7 +8,7 @@ includedOptions="truststore-paths tls-hostname-verifier">
When {project_name} communicates with external services or has an incoming connection through TLS, it has to validate the remote certificate in order to ensure it is connecting to a trusted server. This is necessary in order to prevent man-in-the-middle attacks.
The certificates of these clients or servers, or the CA that signed these certificates, must be put in a truststore. This truststore is then configured for use by Keycloak.
The certificates of these clients or servers, or the CA that signed these certificates, must be put in a truststore. This truststore is then configured for use by {project_name}.
== Configuring the System Truststore

View file

@ -167,7 +167,7 @@ Logging to a file is disabled by default. To enable it, enter the following comm
<@kc.start parameters="--log=\"console,file\""/>
A log file named `keycloak.log` is created inside the `data/log` directory of your Keycloak installation.
A log file named `keycloak.log` is created inside the `data/log` directory of your {project_name} installation.
=== Configuring the location and name of the log file