App Connect

1. If a Platform UI is not yet created, follow the Install a Dashboard with CloudPakForIntegrationProduction license section, steps 1 - 3 to create an instance in your namespace ace-keycloak.
2. When the Platform UI instance becomes Ready, follow the Install a Designer Authoring with AppConnectEnterpriseProduction license section to create a Designer Authoring and log in. You must set license to CloudPakForIntegrationProduction.

Create a user and configure user roles in Keycloak

For IBM® App Connect Operator version 11.0.0, 11.0.1 or 11.1.0, you must follow steps 1 to 3.  For IBM® App Connect Operator version 11.2.0 and later, you can skip steps 1 and 2.  This is because the URIs to the Keycloak UI are now displayed on the Dashboard and Designer Authoring UIs.

1. Find the Cp4iServicesBinding resources managed by your Dashboard and Designer Authoring in the ace-keycloak namespace, which provides the URI to the Keycloak UI. On the navigation pane, select API Explorer, and type Cp4iServicesBinding in the search box. Click the Cp4iServicesBinding Kind.
   
2. Under Instances, you can find the Cp4iServicesBinding resources created by your Dashboard and Designer Authoring. Make sure you are viewing the instances in the ace-keycloak project.

   
   • For Dashboard, click into the resource named <dashboard-name>-dash.  In this tutorial, this is db-01-quickstart-dash.
   • For Designer Authoring, click into the resource named <designerauthoring-name>-designer. In this tutorial, this is des-01-quickstart-ma-designer. 

   Switch to the YAML view to browse the Cp4iServicesBinding CR. You can find the URI to the Keycloak UI in the Cp4iServicesBinding CR. It is in the status.endpoints section, with a name of keycloak and type of ui. For example, in the status as follows, the Keycloak UI is at https://keycloak-ibm-common-services.apps.<cluster URL>.

   status:
   		  endpoints:
   			- name: keycloak
   			  type: ui
   			  uri: >-
   				https://keycloak-ibm-common-services.apps.<cluster URL>

   Note: From Dashboard and Designer Authoring operand version 12.0.11.1-r1 (which is first available in IBM® App Connect Operator version 11), the Keycloak UI are available in the Dashboard and Designer Authoring CRs.
3. Open the Keycloak UI on a browser and click Administration Console.

   
4. You are now at the Keycloak Administration Console.
   
5. To log in, you need to retrieve credentials from your cluster. There are a couple of approaches, depending on the license you used to create your App Connect resources.
   • With an App Connect license, you can use a Secret resource named cs-keycloak-initial-admin.
   • With a Cloud Pak for Integration license, you can, in addition, use a Secret resource named integration-admin-initial-temporary-credentials.
   
   
   For namespace-scoped installations, you can locate those secrets in the namespace, where the App Connect resources are installed. For cluster-wide installations, the secrets are in the ibm-common-services namespace.

   
   

   Both secrets can be revealed by clicking Reveal values, where you can retrieve the values of username and password. The following screenshot shows an example using the cs-keycloak-initial-admin secret.

   
6. Enter the credentials in the Keycloak Administration Console. Once logged in, you must change Realm on the navigation pane to cloudpak.
   
    
7. Click Clients on the navigation pane to view the IntegrationKeycloakClient resources that were created in the ace-keycloak namespace by your Dashboard and Designer Authoring resources.
   
8. Click Users on the navigation pane, and then click Add user to add a new user. You need to provide a username, such as ace-keycloak-test1, and click Create.
   
9. Assign roles to the user by clicking Role mapping, and then Assign role. You need to use the correct filter, by selecting Filter by clients.

   
   • Assigning roles for a Dashboard user
     There are two roles available for App Connect Dashboard, which are dashboard-viewer and dashboard-admin. The former gives you a view-only access to the Dashboard, which means you can only view resources. The latter enables you to perform administrative tasks, such as creating an IntegrationRuntime and uploading a BAR file. Click to select dashboard-viewer for your IntegrationKeycloakClient resource and click Assign to complete.  It is important to note that if both dashboard-viewer and dashboard-admin roles are selected, the role with a higher authority takes precedence. This means, when both roles are selected, a user becomes an admin on the Dashboard.

     
   • Assigning a role for a Designer Authoring user

     There is one role available for App Connect Designer Authoring, which is designerauthoring-admin. The role enables you to perform administrative tasks, such as creating and importing a flow. Click to select designerauthoring-admin for your IntegrationKeycloakClient resource and click Assign to complete.

     
10. Finally you need to set a password for the user.  Select Credentials, click Set password, and then set a password. You can toggle off Temporary for this tutorial (otherwise the user will be prompted to change the password on the first log in).