Operations - SSO

This page describes the operating procedures of the authentication module of the Datachain solution, based on Keycloak. The module settings are described in Configuration - SSO.

Startup and shutdown

Keycloak is started before the Datachain stack: as long as it is not available, some Datachain modules cannot start, because they use security information provided by this service (see Operations - General). It is deployed in its own stack, with the keycloak.env configuration file.

On first startup, the dc-realm realm is created with the Datachain clients, roles and login theme.

Service health check

  • The HTTP port of the service is 8080, under the /auth path.

  • Health check: /auth/health/ready answers UP when the service is operational. The image runs it every 5 minutes, with an initial delay of 2 minutes.

  • Monitoring: /auth/health and /auth/metrics.

Logs

The module logs are written to the standard output of the container.

Backup and restore

Keycloak does not store data on its file system: users, groups and sessions are in the keycloak PostgreSQL database. Back up this database (see Operations - Data management), preferably cold, after stopping Keycloak.

Update

The Keycloak version is aligned with the Keycloak major version, and kept up to date by Adobis. Follow the indications of the technical release notes regarding the version to keep, and back up the keycloak database before any update.

Dernière mise à jour le 2 novembre 2026 à 15:16