Learn Keycloak - Pre-Requisites & Setup Environment

#Introduction

Welcome to episode 0 of the Learn SSO with Keycloak series! This series takes you from zero to ready to build a centralized identity platform: understanding what Single Sign-On (SSO) is, mastering identity protocols such as OAuth 2.0 and OpenID Connect, and then operating Keycloak as the authentication authority for all your applications. Before we dive into the core material, this episode makes sure your skills, software, and environment are truly ready.

SSO is a simple concept with a huge impact: one authentication, access to many applications. Instead of logging in again on every system, users log in once at the identity center, and that center handles authentication, sessions, and access policies. In this series, that center is Keycloak.

#What Is SSO and the Series Roadmap

SSO (Single Sign-On) means a user authenticates once at an identity provider, then the token obtained is used to access many applications without logging in again. Keycloak is an open-source identity and access management (IAM) solution from Red Hat that implements this concept with full support for OAuth 2.0, OpenID Connect, SAML 2.0, and LDAP.

The series roadmap consists of 31 episodes across several phases:

• Phase 1 (episodes 0-3): pre-requisites, the history of SSO, identity protocol overview, and Keycloak architecture.
• Phase 2 (episodes 4-8): OAuth 2.0 deep dive — grant types, tokens, scopes, and consent.
• Phase 3 (episodes 9-11): OpenID Connect — ID tokens, claims, and session management.
• Phase 4 (episodes 12-14): SAML 2.0 — Keycloak as a SAML IdP and service provider integration.
• Phase 5 (episodes 15-18): user federation, social login, SCIM, and groups & roles management.
• Phase 6+ (episodes 19-31): production installation, themes, events & auditing, MFA, security, and production deployment.

Episode 0 is the foundation: make sure your skills and environment are ready before you start touching Keycloak.

#Essential Skills You Must Master

Learning Keycloak is not just about clicking buttons in the admin console. You will read configuration, understand tokens, and debug authentication flows. Master these skills at least at an intermediate level:

• Authentication vs authorization — distinguishing "who you are" from "what you're allowed to access"; this is what sets OAuth 2.0 apart from OpenID Connect.
• Basic cryptography concepts — public/private keys, certificates, signatures, and the JWT structure.
• HTTP fundamentals — headers, cookies, redirects, and status codes; the entire SSO flow runs over HTTP.
• RESTful API concepts — understanding endpoints, methods, and JSON payloads.
• JSON and XML — JSON is used by OAuth 2.0 and OIDC; XML is used by SAML.
• Basic web security — understanding XSS and CSRF because both are closely tied to redirect URIs and the state parameter.
• DNS basics — understanding hostnames and how browsers are directed to the Keycloak server.
• IAM understanding — terms like realm, client, user, role, and group will become your daily vocabulary.

#Software & Tools You Need to Prepare

Have at least the following tools ready on your machine:

The main focus of this episode is Docker because it's the fastest way to start experimenting. JDK still matters because understanding how Java works helps when you tune the Keycloak JVM in production.

#Hardware and VM Requirements

The following specs are comfortable for following the entire series:

• Minimum 4 GB RAM, 8 GB or more recommended.
• Minimum 20 GB of free storage for images, the database, and sample applications.
• Minimum dual-core CPU.
• Multiple VMs are optional, useful when simulating a production deployment with several instances.
• A stable network connection for pulling images and accessing documentation.

For most episodes, a single local machine is enough. Additional VMs are only needed when you reach the deployment and clustering phases.

#Setup Environment: Running Keycloak with Docker

The fastest way to run Keycloak is via the official image on quay.io. Keycloak 25 and above sets the initial admin through the KC_BOOTSTRAP_ADMIN_USERNAME and KC_BOOTSTRAP_ADMIN_PASSWORD environment variables:

docker run -d \
  --name keycloak \
  -p 8080:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
  -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin123 \
  quay.io/keycloak/keycloak:latest start-dev

The docker run command above runs Keycloak in start-dev mode — a convenient development mode that doesn't require HTTPS configuration or an external database. This mode is not for production; it's for learning.

If you prefer docker-compose, create the following file:

services:
  keycloak:
    image: quay.io/keycloak/keycloak:latest
    command: start-dev
    ports:
      - "8080:8080"
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin123
    volumes:
      - keycloak-data:/opt/keycloak/data
 
volumes:
  keycloak-data:

Run it with docker compose up -d, then check the logs with docker logs -f keycloak. Keycloak is ready when the logs show a message indicating the server has started.

#The Realm Concept

Once Keycloak is running, the first thing you need to understand is the realm. A realm is an isolation space (namespace) that separates a set of users, clients, roles, and configuration from other realms. Think of a realm as a "tenant" within Keycloak.

Every Keycloak installation has a special realm named master reserved for administration. When building your own applications, the best practice is to create a new realm — don't use the master realm for business applications.

#Verifying the Installation

Run the following checks to make sure everything is working:

1. Open http://localhost:8080 in your browser. You'll be directed to the Keycloak welcome page.
2. Select the Administration Console menu and log in with admin and the password you set earlier.
3. On the left sidebar, make sure you see a realm dropdown with the value master.
4. Try creating a new realm via the Create Realm button, name it e.g. belajar, then delete it if you don't need it.

If the admin console page opens and you can create a realm, your environment is ready for the entire series.

#Closing

Episode 0 laid the foundation: you understand this series' place across 31 episodes, you've mastered the essential skills list, you've prepared the required software and hardware, and you've run Keycloak with Docker in development mode. You've also been introduced to the realm concept.

Key takeaways:

• Docker is the fastest path — docker run with start-dev is enough to get started without complicated configuration.
• A realm is the isolation boundary — each application should have its own realm rather than using master.
• HTTP, cryptography, and IAM skills matter — everything that follows is built on them.
• start-dev mode is not for production — the production deployment episodes will cover the right way to do it.

In the next episode (episode 1), we step back to understand why SSO is needed — the evolution of authentication, the problem of password fatigue, and the benefits and risks of SSO before you start adopting it in your organization.