54 lines
No EOL
3.8 KiB
Text
54 lines
No EOL
3.8 KiB
Text
<#import "/templates/guide.adoc" as tmpl>
|
|
<#import "/templates/kc.adoc" as kc>
|
|
<#import "/templates/links.adoc" as links>
|
|
|
|
<@tmpl.guide
|
|
title="Configuring Keycloak for production"
|
|
summary="Learn how to make Keycloak ready for production."
|
|
includedOptions="">
|
|
|
|
A Keycloak production environment provides secure authentication and authorization for deployments that range from on-premise deployments that support a few thousand users to deployments that serve millions of users.
|
|
|
|
This {section} describes the general areas of configuration required for a production ready Keycloak environment. This information focuses on the general concepts instead of the actual implementation, which depends on your environment. The key aspects covered in this {section} apply to all environments, whether it is containerized, on-premise, GitOps, or Ansible.
|
|
|
|
== TLS for secure communication
|
|
Keycloak continually exchanges sensitive data, which means that all communication to and from Keycloak requires a secure communication channel. To prevent several attack vectors, you enable HTTP over TLS, or HTTPS, for that channel.
|
|
|
|
To configure secure communication channels for Keycloak, see <@links.server id="enabletls"/> and <@links.server id="outgoinghttp"/>.
|
|
|
|
== The hostname for Keycloak
|
|
In a production environment, Keycloak instances usually run in a private network, but Keycloak needs to expose certain public facing endpoints to communicate with the applications to be secured.
|
|
|
|
For details on the endpoint categories and instructions on how to configure the public hostname for them, see <@links.server id="hostname"/>.
|
|
|
|
== Reverse proxy in a distributed environment
|
|
Apart from <@links.server id="hostname"/>, production environments usually include a reverse proxy / load balancer component. It separates and unifies access to the network used by your company or organization. For a Keycloak production environment, this component is recommended.
|
|
|
|
For details on configuring proxy communication modes in Keycloak, see <@links.server id="reverseproxy"/>. That {section} also recommends which paths should be hidden from public access and which paths should be exposed so that Keycloak can secure your applications.
|
|
|
|
== Production grade database
|
|
The database used by Keycloak is crucial for the overall performance, availability, reliability and integrity of Keycloak. For details on how to configure a supported database, see <@links.server id="db"/>.
|
|
|
|
== Support for Keycloak in a cluster
|
|
To ensure that users can continue to log in when a Keycloak instance goes down, a typical production environment contains two or more Keycloak instances.
|
|
|
|
Keycloak runs on top of JGroups and Infinispan, which provide a reliable, high-availability stack for a clustered scenario. When deployed to a cluster, the embedded Infinispan server communication should be secured. You secure this communication either by enabling authentication and encryption or by isolating the network used for cluster communication.
|
|
|
|
To find out more about using multiple nodes, the different caches and an appropriate stack for your environment, see <@links.server id="caching"/>.
|
|
|
|
== Configure Keycloak Server with IPv4 or IPv6
|
|
The system properties `java.net.preferIPv4Stack` and `java.net.preferIPv6Addresses` are used to configure the JVM for use with IPv4 or IPv6 addresses.
|
|
|
|
By default, Keycloak is accessible via IPv4 and IPv6 addresses at the same time.
|
|
In order to run only with IPv4 addresses, you need to specify the property `java.net.preferIPv4Stack=true`.
|
|
The latter ensures that any hostname to IP address conversions always return IPv4 address variants.
|
|
|
|
These system properties are conveniently set by the `JAVA_OPTS_APPEND` environment variable.
|
|
For example, to change the IP stack preference to IPv4, set an environment variable as follows:
|
|
|
|
[source, bash]
|
|
----
|
|
export JAVA_OPTS_APPEND="-Djava.net.preferIPv4Stack=true"
|
|
----
|
|
|
|
</@tmpl.guide> |