🔐 Logging into Keycloak via SSO: Best practices for admins

Hi everyone 👋

By default, Keycloak admin access is limited to a single account with fixed credentials provided by Ataccama. But just as we recommend using SSO for logging into the Ataccama platform, it’s also best practice for Keycloak administrators to log in the same way—for better security, auditability, and ease of access.
 

Here’s a quick guide to help you set up and enable SSO login for Keycloak admins 👇
 

1️⃣ Set up admin access in Keycloak

First, log in to your Keycloak instance using the default admin credentials at:

<your_env>/auth

Once logged in:

• Switch to the ataccamaone realm
  
• Go to the Realm Roles tab
• Decide whether to use an existing role (e.g., admin) or create a new one (e.g., Keycloak_Admin) based on your security requirements

2️⃣ Assign the right permissions

Open the role you've selected or created:

• Navigate to the Associated Roles tab and click Assign Role
  
• Under Filter by, select Clients
  

Now assign the appropriate permissions. At a minimum, these should include:

• manage-account
• view-applications
• view-profile
• view-realm

For full admin control, we recommend including all relevant permissions for identity providers, clients, users, groups, and events. We often see first-time clients selecting all Keycloak related roles for their admins. This aligns with the personas of administrators, and makes setup/ownership easier, and is therefore a reasonable approach.

⚠️ Note: The impersonation role allows an admin to act as another user. While this is logged in the Keycloak Events log, it’s good to review whether this permission is necessary in your environment.

3️⃣ Map the role to active directory

Use your existing identity provider setup to map the selected role to your AD group. Follow your standard process or check our documentation for guidance.

4️⃣ Logging in via SSO

To access the Keycloak admin console using SSO, don’t use <env>/auth. Instead, go to:

👉 <env>/auth/admin/ataccamaone/console/#/

This will redirect users to the standard Ataccama login page, where they can log in using SSO credentials.

Have questions or need help with configuration? Let us know in the comments below! 👇