keycloak安装

一、关闭防火墙

sudo systemctl stop firewalld
sudo systemctl disable firewalld

二、准备工作
2.1安装postgres

略过

2.2必要工具

sudo dnf install -y wget unzip java-17-openjdk-devel

2.3安装 Java 17

# 检查 Java 版本
java -version  # 应显示 OpenJDK 17

# 设置默认 Java
sudo alternatives --config java

2.4下载 Keycloak

# 创建安装目录
sudo mkdir -p /opt/keycloak
sudo chown `whoami` /opt/keycloak

# 下载最新版（以 Keycloak 22.0.5 为例）
wget https://github.com/keycloak/keycloak/releases/download/22.0.5/keycloak-22.0.5.zip
unzip keycloak-22.0.5.zip -d /opt/keycloak
mv /opt/keycloak/keycloak-22.0.5/* /opt/keycloak/

2.5创建专用用户

sudo useradd -r -s /sbin/nologin keycloak
sudo chown -R keycloak:keycloak /opt/keycloak

2.6配置 PostgreSQL 数据库如果在别的节点已经部署过了略过这步

# 安装 PostgreSQL
sudo dnf install -y postgresql-server

# 初始化数据库
sudo postgresql-setup --initdb

# 启动服务
sudo systemctl enable postgresql --now

# 创建 Keycloak 数据库和用户
sudo -u postgres psql <<EOF
CREATE USER keycloak WITH PASSWORD 'axing123456';
CREATE DATABASE keycloak OWNER keycloak;
GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;
EOF

2.7配置 Keycloak

cd /opt/keycloak/conf
vim keycloak.conf

# 主机名
hostname=k8s-02

# 数据库配置 (Quarkus格式)
quarkus.datasource.db-kind=postgresql
quarkus.datasource.jdbc.driver=org.postgresql.Driver
quarkus.datasource.jdbc.url=jdbc:postgresql://192.168.30.23:5432/keycloak
quarkus.datasource.username=keycloak
quarkus.datasource.password=axing123456

# 网络设置
http-host=0.0.0.0
http-port=32399
hostname-strict=false
hostname-strict-https=false
http-enabled=true

# 设置上下文路径为 /auth
http-relative-path=/auth

# 启用 Token Exchange
features=token-exchange

# 开启客户端凭据授权 (Token Exchange 需要)
oidc-client-credentials-grant-enabled=true

# 启用域间 Token Exchange
token-exchange-enabled=true

三、创建 Systemd 服务
3.1配置

sudo vim /etc/systemd/system/keycloak.service

[Unit]
Description=Keycloak Service
After=network.target postgresql.service

[Service]
User=keycloak
Group=keycloak
ExecStart=/opt/keycloak/bin/kc.sh start --optimized
WorkingDirectory=/opt/keycloak
Restart=always
RestartSec=30
Environment="KEYCLOAK_ADMIN=admin"
Environment="KEYCLOAK_ADMIN_PASSWORD=axing123456"

[Install]
WantedBy=multi-user.target

3.2配置时间时区

# 创建配置文件目录
sudo mkdir -p /etc/systemd/system/keycloak.service.d/

# 创建时区配置文件
sudo tee /etc/systemd/system/keycloak.service.d/timezone.conf <<EOF
[Service]
Environment="JAVA_TOOL_OPTIONS=-Duser.timezone=Asia/Shanghai"
EOF

# 重新加载 systemd
sudo systemctl daemon-reload

3.3 启动服务

sudo systemctl daemon-reload
sudo systemctl enable keycloak
sudo systemctl start keycloak

3.4其他

# 从Keycloak服务器测试连接
PGPASSWORD="axing123456" psql -U keycloak -h 192.168.30.23 -p 5432 -d keycloak -c "SELECT version();"
#测试上下文
curl http://192.168.30.21:32399/realms/master/.well-known/openid-configuration
curl http://localhost:32399/realms/master/.well-known/openid-configuration

评论 (0)