Keycloak | AiStrike Documentation

This guide will walk you through the steps to create a service account (client) in Keycloak, assign a read-only role with the necessary permissions, and retrieve the client secret for API authentication.◼︎

Prerequisites

Before you begin, please ensure you have:

Admin access to the Keycloak Admin Console for the relevant realm. You must be able to create clients, roles, and manage role assignments.
The realm name where you want to create the service account.
Network access to the Keycloak server (URL and port) from AiStrike Public IPs.

AiStrike Public IP list: 3.135.165.25/32, 3.148.24.98/32, 52.15.138.222/32

Step 1: Log in to Keycloak Admin Console

Open your Keycloak Admin Console in a browser. Example URL: https://your-keycloak-domain/auth/admin/
Log in with an admin account that has permission to manage clients and roles.

Step 2: Create a New Client (Service Account)

In the left sidebar, click on Clients.
Click on the Create client button to add a new client.
General settings page:
- Client ID: Enter AiStrike-Service-Account.
- Client Protocol: Select openid-connect.
- Description: Read only service account for AiStrike.
- Click Next.
Capability config page:
- Enable Client authentication & Authentication toggle.
- Leave all other settings as it is.
- Click Next.
Login settings page:
- Leave all fields blank [Root URL, Home URL, Valid redirect URLs, Valid Post logout redirect URLs, Web origins etc.].
- Click Save.

Step 3: Create a Role with Read-Only Permissions

In the left sidebar, go to Clients and click the newly created Service Client for AiStrike under your realm.
Go to the tab Role & Click Create Role.
Enter a role name e.g., AiStrike-read-only-role.
Add a description (optional), such as "AiStrike Read-only permissions for API access."
Click Save.
Once Saved you should be able to assign permission to role using "Associated roles tab".
Click Assign roles and select the read only permissions as per table in next step.

Step 4: Assign Read-Only Permissions to the Role

Use the following list of permissions to assign to your role. This is typically done under Realm Roles or Client Roles depending on your setup.

Key Permissions to include:

Permission Category	Role Name	Description
View Applications	`role_view-applications`	Read access to applications
View Consent	`role_view-consent`	Read access to consent data
View Groups	`role_view-groups`	Read access to group info
View Profile	`role_view-profile`	Read access to user profile data
Read Token	`role_read-token`	Allows introspection of tokens (e.g., validate tokens and check scopes)
Query Clients	`role_query-clients`	Read access to clients
Query Groups	`role_query-groups`	Read access to groups
Query Realms	`role_query-realms`	Read access to realm configurations
Query Users	`role_query-users`	Read access to user listings
View Authorization	`role_view-authorization`	Read access to authorization settings
View Clients	`role_view-clients`	Read access to client details
View Events	`role_view-events`	Read access to event logs
View Identity Providers	`role_view-identity-providers`	Read access to identity providers
View Realm	`role_view-realm`	Read access to realm settings
View Users	`role_view-users`	Read access to users

Step 5: Assign Role to the Service Account

Go back to Clients > Select your AiStrike-Service-Account client.
Click on the Service Account Roles tab.
Assign the newly created AiStrike-read-only-role role (or the corresponding realm/client roles with read permissions).

Step 6: Retrieve the Client Secret

Still in the client page, click on the Credentials tab.
You will see the Client Secret here. Copy this value securely as it will be used for API authentication.

Full Keycloak URL: e.g., https://your-keycloak-domain/auth
Realm Name: e.g., YourRealm
Service Account (Client) Name: AiStrike-Service-Account
Client Secret: (copy from Credentials tab)

For any further assistance, please reach out to your AiStrike representative.