Manage realm settings
Each Keycloak realm comprises a set of clients and users, together with associated roles and groups. Realms are isolated from one another and can only manage and authenticate the users that belong to them.
The WorkFusion-integrated Keycloak service features two preconfigured realms:
Master realm, which is the super admin console to manage Keycloak settings as well as the settings of the WorkFusion realm together with associated clients, groups, and users.
WorkFusion realm allows managing clients, users, roles, groups, and credentials associated with using WorkFusion applications (Control Tower, WorkSpace, and Kibana) or external identity and storage providers.
note
The super admin can modify settings both within the master realm and other realms (for example, WorkFusion realm). A realm admin can modify their own realm settings only.
Use the super admin functionality for the initial Keycloak setup and emergencies (for example, when a realm admin forgets the password).
All created realms are available on the realm menu in the left-hand corner of the Keycloak console. To switch between the realms, click the dropdown menu button and select any of the menu items.
Access realm settings
To access the settings of a realm, follow the instructions below:
- In the top left corner of the Keycloak console, select the required realm.
- On the left menu, select Realm Settings. On the right, you will see the realm configuration page with several tabs.
The realm settings in both the master and the WorkFusion realms are preconfigured for you. It is not recommended to change them, but for a few exceptions:
- On the General tab, you can enable or disable the realm by turning on or off the Enabled toggle accordingly.
- On the Email tab, configure the SMTP server to receive email notifications about Keycloak server events (for example, a user locked out after a login failure).
- On the Security Defenses tab, you can configure user lockouts to prevent brute force attacks.
- On the Themes tab, you can configure locale settings to support a language other than the default English.
Configure email notifications
For the email notification functionality to work correctly, configure the SMTP server settings and verify that users have valid email configuration.
Configuring the SMTP server settings
Make sure you are in the right realm. On the left menu, select Realm settings and go to the Email tab.
On the tab, configure the following settings:
- Host: specify the SMTP server hostname for sending emails.
- Port: specify the SMTP server port.
- From: enter the address to be used for the From SMTP-Header for any emails sent. From Display Name (optional): specify user-friendly email address aliases. If not specified, email clients display the plain From email address only.
- Reply To (optional): set the address used for the Reply-To SMTP-Header for any emails sent. If not specified, email clients display the plain From email address only.
- Reply To Display Name (optional): set user-friendly email address aliases. If not specified, email clients will display the plain Reply To email address.
- Envelope From (optional): specify the Bounce Address used for the Return-Path SMTP-Header.
- Since emails can be used to update or recover user names and passwords, it’s a safe practice to enable SSL or TLS, especially if the SMTP server is on an external network. To do this, turn on the Enable SSL or Enable StartTLS toggle accordingly. Most likely, you will also have to change the value in the Port field (the default port for SSL/TLS is 465).
- If your SMTP server requires authentication, turn on the Enable Authentication toggle and set the Username and Password. The value of the Password field can refer to a value from an external vault.
After you complete the setup, make sure to click the Save button to save the changes.
Verifying users' email configuration
On the left menu, click Users and select a specific user.
On the Details tab, check that the Email field contains the user's valid email address, and the Email Verified switch is on. This means the user's email is verified as appropriate, and the user can receive email notifications about Keycloak server events and use the email to log into WorkFusion.
If the switch is off, complete the verification for the email notification functionality to work correctly. To do this, select Verify Email in the Required User Actions field.
When you select the option, the user receives a message with a link to verify the email at their first attempt to log in.
Clicking the Link to email address verification in the message completes the verification procedure, enabling the user to receive notifications and use the email to log into WorkFusion.
Configure locale settings
Keycloak supports internationalization. The default language is English, but you can choose another one from a collection of supported locales.
To enable the internationalization feature, complete the following steps:
- In the top left corner of the Keycloak console, select the required realm.
- On the left menu, select Realm Settings and go to the Themes tab.
- Turn on the Internationalization Enabled toggle.
- In the Supported Locales section, you can see the list of available locales. Select your default locale in the Default Locale dropdown box and click Save.
