Keycloak (hướng dẫn admin)

Keycloak (admin guide)

Keycloak is deployed on Dohub at keycloak.example.com — IAM for apps (Overleaf, …).

Sign in to admin console

1. Open https://keycloak.example.com/admin/.
2. Sign in with the master realm admin account (provided by the operator).

Create a realm

1. Realm dropdown (top left) → Create realm.
2. Realm name — e.g. overleaf.
3. Click Create.

Create a client

1. Clients → Create client.
2. Client ID — must match app config (e.g. Overleaf OIDC).
3. Client authentication — ON for confidential clients.
4. Valid redirect URIs — app callback URLs.
5. Web origins — CORS if needed.
6. Save the Client secret (Credentials tab) for the app.

Groups

1. Groups → Create group — e.g. overleaf-users.
2. Members → Add member, search for user (e.g. daovietanh19 for Overleaf demo).

Roles

1. Realm roles or Client roles → Create role.
2. Assign roles to a group: Groups → group → Role mapping → Assign role.

Overleaf typically maps Keycloak groups to project access — see Overleaf.