Identity domains: console walkthrough

The same operations as the step-by-step guide, done in the console.

This console page has a guided tour

Click Start the tour beside the create button for a walkthrough that highlights each field as you go.

List

Switch to the IAM perspective, then Domains.

The status column reports OK once the realm exists on the identity server.

A Set up IAM button means there is no server yet

If the button at the top right reads Set up IAM rather than Create Domain, the project has no identity server. Click it and let it finish - it provisions the server the domains live on, and takes a few minutes. Everything else in the IAM perspective depends on it.

Create

Create Domain opens a form with a single field.

Domain name is the domain your users belong to, written as you would write it - example.com. Lowercase letters, numbers, hyphens and dots only.

The form converts it to a valid Kubernetes object name behind the scenes by replacing dots with hyphens, so you do not have to. The converted name still has to fit 63 characters, which is the one case where a legitimate domain is rejected.

Use the real domain. It appears in sign-in pages and in tokens, and it cannot be renamed.

Change

A domain cannot be renamed, and the console offers no edit form.

Settings inside the realm - password policies, session lifetimes, themes - are managed in Keycloak itself rather than here. This page creates the realm and reports its health.

Delete

Use the kebab menu at the end of the row.

This deletes every identity in the domain

Users, groups and clients all belong to the realm. Deleting it removes them, and anything authenticating against it stops working immediately.

The user, group and client entries in your project are left behind pointing at a realm that no longer exists. Delete them too - see Delete.

Where the console differs from the CLI

	Console	oc
Object name	Derived from the domain for you	You replace the dots yourself
Server reference	Filled in	You write out spec.keycloakRef
Missing server	Offers Set up IAM in place of Create	The object is created and reports an error
Realm settings	Not exposed - use Keycloak	Not exposed either