Keycloak Upgrade#

With the release of Anaconda Enterprise 5.6, significant improvements have been made to our Keycloak implementation. For details, please see the release notes.

Upgrading to Anaconda Enterprise 5.6 requires Keycloak configuration changes to access your instance. You’ll need to add a service account with correct permissions to the anaconda-platform client, then add a protocol mapper to the roles client scope.

Enabling the service account#

After your upgrade to Anaconda Enterprise 5.6+ completes:

  1. Open a browser and log in to your Keycloak admin panel using your existing Keycloak credentials. Your Keycloak admin panel can be found at https://<FQDN>auth/admin where <FQDN> is your Anaconda Enterprise fully qualified domain name.

  2. Verify you are on the anaconda-platform realm.

    ../../_images/kc_anaconda_platform_realm.png

  3. Select Clients from the left-hand navigation, then select anaconda-platform from the list of available clients.

    ../../_images/kc_clients_anaconda_platform.png

  4. Select the Service accounts roles checkbox under Capability config, then save your changes.

    ../../_images/kc_client_config_service_account_roles.png

  5. Select the new Service accounts roles tab that appears at the top of the page.

  6. Click Assign role.

    ../../_images/kc_assign_service_account_roles.png

  7. Open the filter dropdown menu and select Filter by clients.

    ../../_images/kc_role_filter_options.png

  8. Search for the view-users role.

  9. Select the role, then click Assign.

    ../../_images/kc_assign_view_users_role.png

Adding the protocol mapper#

  1. Select Client scopes from the left-hand navigation, then select roles from the list of available client scopes.

    ../../_images/kc_roles_client_scope.png

  2. Select the Mappers tab.

  3. Open the Add mapper dropdown menu and select By configuration.

    ../../_images/kc_add_protocol_mapper.png

  4. Select Audience.

    ../../_images/kc_audience_mapper.png

  5. Complete the fields and set the toggle switches as indicated:

    • Name - my-audience

    • Included Client Audience - anaconda-platform

    • Add to ID token - ON

    • Add to access token - ON

  6. Click Save.

    ../../_images/kc_create_protocol_mapper.png

Success! You can now log in to your instance from an existing account and use AE5 normally.