Skip to content

Users

A user is a person who can sign in to the applications registered against one of your domains.

Two decisions outlast their first day: which groups they are in, which is what actually decides what they can reach, and how they get their first password.

For the same steps in the console, see the console walkthrough.

Create

user.yaml
apiVersion: v1.edp.epam.com/v1
kind: KeycloakRealmUser
metadata:
  name: <username>
  namespace: <project>
spec:
  username: <username>
  enabled: true
  email: <email>
  emailVerified: true
  firstName: <first>
  lastName: <last>
  realmRef:
    name: <domain-object-name>
  groups:
    - <group>

oc apply -f user.yaml

realmRef takes the object name, not the domain

realmRef.name is the metadata.name of the KeycloakRealm - the one with hyphens instead of dots, such as example-com.

metadata.name must be a valid Kubernetes name, so a username containing an @ or other characters has to be sanitised for the object name while spec.username keeps the real value.

Setting emailVerified: true asserts the address rather than asking the person to confirm it. Only do that for an address you know is theirs.

groups is what decides access. A user in no groups can sign in and reach nothing, which is a reasonable starting point but rarely what was meant.

An initial password

Leave it out and the account is created without one; the person gets in through whatever recovery route the domain offers, and no password ever passes through you.

If you do need to hand someone a working password, put it in a Secret and reference it:

password-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: <username>-initial-password
  namespace: <project>
type: Opaque
stringData:
  password: <password>

spec:
  passwordSecret:
    name: <username>-initial-password
    key: password
    temporary: true

temporary: false creates a password that never has to change

Keep it true so the password you chose stops working as soon as they use it. The value sits in a Secret in the project either way, readable by anyone who can read secrets there - which is a good reason for it to be short-lived.

List

oc get keycloakrealmusers.v1.edp.epam.com -n <project>

oc get keycloakrealmusers.v1.edp.epam.com <name> -n <project> \
  -o jsonpath='{.status.value}{"\n"}'

An error naming a group means a group listed on the user does not exist in the realm.

Change

Group membership lives on the user, so this is where you add someone to a group:

oc patch keycloakrealmusers.v1.edp.epam.com <name> -n <project> \
  --type=merge -p '{"spec":{"groups":["<group>","<other-group>"]}}'

The list replaces rather than adds - include the groups they already have.

To disable an account without deleting it:

oc patch keycloakrealmusers.v1.edp.epam.com <name> -n <project> \
  --type=merge -p '{"spec":{"enabled":false}}'

That is the right move when someone leaves: it stops sign-in immediately while keeping their history and their group membership intact.

The username cannot be changed.

Delete

oc delete keycloakrealmusers.v1.edp.epam.com <name> -n <project>
oc delete secret <username>-initial-password -n <project>

The password Secret is a separate object and is not deleted with the user. Delete it as soon as the person has signed in and changed their password - it has no further use.

Prefer enabled: false to deletion when someone leaves, unless you have a reason to erase them.