Setting up Keycloak

Documentation Index

Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

​

Prerequisites

• A running Keycloak server (self-hosted or cloud) with admin access to a realm
• Bifrost Enterprise deployed and accessible
• The redirect URI for your Bifrost instance (e.g. https://your-bifrost-domain.com/login)
• Bifrost roles created for the roles you plan to map

​

Step 1: Create a Client

1. In the Keycloak Admin Console, select your realm and go to Clients → Create client.

2. Configure the client:

3. On the Capability config step enable:
   • Client authentication (makes it a confidential client)
   • Standard flow (Authorization Code)
   • Service accounts roles (required for Admin REST API access)

4. On the Login settings step set:

5. Save the client.

​

Step 2: Copy the client credentials

1. Open the client and go to the Credentials tab.
2. Copy the Client Secret.

​

Step 3: Configure role and group mappers

1. Open the client → Client Scopes tab → click the client’s -dedicated scope.
2. Click Add mapper → By configuration.

​

Group Membership mapper

​

Realm Roles mapper

​

Step 4: Assign Admin REST API permissions

1. Open the client → Service accounts roles tab.
2. Click Assign role and select:
   • realm-management → view-users (required)
   • realm-management → view-realm (recommended, enables group and role listing)
   • realm-management → query-groups (optional, for group filters)

​

Step 5: Create realm roles and groups

1. Realm → Realm roles → Create role for each role (e.g. bifrost-admin, bifrost-developer, bifrost-viewer).
2. Realm → Groups → Create group for each team you want to sync (e.g. /platform, /data-science).
3. Assign users to the appropriate roles and groups under Users → your user → Role mapping / Groups.

​

Step 6: Configure Bifrost

​

Using the Bifrost dashboard

1. In Bifrost, go to Governance → User Provisioning.
2. Select Keycloak as the SCIM Provider.
3. Fill in the fields:

4. Click Verify - Bifrost connects to Keycloak’s JWKS and Admin REST API to confirm the client and service-account roles.
5. Configure Attribute → Role / Team / Business Unit mappings if needed.
6. Toggle Enabled and click Save Configuration.

​

Using config.json

{
  "scim_config": {
    "enabled": true,
    "provider": "keycloak",
    "config": {
      "serverUrl": "https://keycloak.company.com",
      "realm": "bifrost-prod",
      "clientId": "bifrost",
      "clientSecret": "${KEYCLOAK_CLIENT_SECRET}",
      "teamIdsField": "groups"
    }
  }
}

​

Configuration reference

​

Testing the Integration

1. Open the Bifrost dashboard in an incognito window.
2. You’ll be redirected to Keycloak’s login page.
3. Sign in with a Keycloak user that has one of the roles you mapped.
4. Verify the user appears under Governance → Users with the expected role and teams.
5. From Governance → User Provisioning → Import Users, verify the service account can list users.

​

Troubleshooting

​

serverUrl must not include /realms/{realm}

​

Users redirected back to login

• Confirm the client’s Valid redirect URIs exactly match your Bifrost login URL (trailing slash matters).
• Verify the client is Enabled in Keycloak.

​

Roles not appearing in the token

• Check that the User Realm Role mapper adds to both ID and Access tokens.
• Use Evaluate on the client scope to preview the token a user would receive.

​

Service account cannot list users

• Confirm realm-management → view-users is assigned under Service accounts roles.
• If you enabled Authorization on the client, service account tokens may not work - disable Authorization (fine-grained authz) for this client.

​

jwks keys not found

• Make sure the server URL is reachable from Bifrost. The JWKS endpoint is {serverUrl}/realms/{realm}/protocol/openid-connect/certs.

​

Next Steps

• User Provisioning overview - capabilities, attribute mappings, bulk import
• Role-Based Access Control - configure custom roles before mapping
• Audit Logs - track authentication events