IOModel Studio

Keycloak

ID	iomodel.keycloak
Description	Identity provider / SSO (optional).
Key	keycloak
Type	deployment

Table of contents

Keycloak Guide

Why it's needed

Deployment

Keycloak Guide

Keycloak is the identity provider for the stack. It owns users, credentials, and sessions, and speaks OpenID Connect so Studio never has to store passwords itself.

Role in the stack

Studio delegates sign-in to Keycloak via OIDC. Keycloak can also federate to enterprise SSO (LDAP, SAML, social logins), making it the single place to manage identity.

Why it’s needed

No passwords in the app — authentication is delegated; Studio only trusts signed tokens.
SSO & federation — connect existing corporate identity providers.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: iomodel
spec:
  replicas: 1
  selector: { matchLabels: { app: keycloak } }
  template:
    metadata: { labels: { app: keycloak } }
    spec:
      containers:
        - name: keycloak
          image: quay.io/keycloak/keycloak:latest
          args: ['start', '--optimized']
          env:
            - name: KC_DB
              value: postgres
            - name: KC_HOSTNAME
              value: iomodel.example.com
          ports: [{ containerPort: 8080 }]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: iomodel
spec:
  replicas: 1
  selector: { matchLabels: { app: keycloak } }
  template:
    metadata: { labels: { app: keycloak } }
    spec:
      containers:
        - name: keycloak
          image: quay.io/keycloak/keycloak:latest
          args: ['start', '--optimized']
          env:
            - name: KC_DB
              value: postgres
            - name: KC_HOSTNAME
              value: iomodel.example.com
          ports: [{ containerPort: 8080 }]

Set KC_HOSTNAME (and KC_PROXY when behind the reverse proxy) to the public origin. A wrong hostname/issuer is the most common cause of redirect loops.

Links and Communications

2 incoming links · 1 workflow

Incoming Links(2)

Source object	Label	Link type	Relation	Raw id	Required	Description
Reverse Proxy deployment.iomodel.reverse_proxy ingress_controller	routes auth to	—	links	iomodel.keycloak	—	—
IOModel Studio deployment.iomodel.studio deployment	authenticates via	—	links	iomodel.keycloak	—	—

Related Workflows(1)

Workflow	Model	Participant id	Participant label
User sign-in sign-in	deployment	iomodel.keycloak	Keycloak