Datamodel

Global SaaS Realm

There is one and only one global SaaS realm. Its just a set of users and a relationship to which Application Realms they have created.

SaaS realm

1..N Users

SaaS User

1..N Application Realms

Application Realms

UserRoleMapping

• User
• Role

ScopeMapping

Defines what roles an oauth client is allowed to request

• User
• Role

RequiredCredential

• Type - password, totp, cert
• input - whether login form input is required
• secret - whether the credential should be masked on the login form (like password)

Realm

• name
• public/private key, and other config attributes
• 1..N Users
• 1..N Roles
• 1..N UserRoleMappings
• 1..N ScopeMappings
• 1..N RequiredCredential for users
• 1..N RequiredCredential for resources
• 1..N RequiredCredential for oauth clients
• 1..N Resource

Default Realm Roles

• 'KEYCLOAK_GRANT_NOT_REQUIRED' - doesn't require the oauth grant page
• 'KEYCLOAK_LOGIN_ALLOWED' - is allowed to request a login
• 'KEYCLOAK_REALM_ADMIN' - allowed to administer the realm.
• '*' Wildcard, allow everything

Resource

A User is created within the realm with the same name as the resource. This is so the resource can request access tokens. This User will be granted the KEYCLOAK_GRANT_NOT_REQUIRED and KEYCLOAK_LOGIN_ALLOWED roles. It will have a resource scope mapping of '*'. An OAuth Client mapping will be created too with the Resource's allowed redirect pattern

• Name
• 1..N Roles
• 1..N UserRoleMappings
• 1..N ScopeMappings
• admin URL - Keycloak server can make requests to this URL for things like logout
• 1..N Redirect Pattern

Redirect Pattern

• URL pattern

Default Resource Roles

• '*' Wildcard, allow everything
• 'KEYCLOAK_RESOURCE_ADMIN'

OAuth client

An OAuth client is a user that is allowed to initiate the token protocol. They have Redirect Patterns associated with them.

• User
• 1..N Redirect Pattern