> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Keycloak hands-on examples

> Examples showing how to configure and use Keycloak for authentication and identity management.

The Keycloak hands-on examples page demonstrates how to use Keycloak.

## Manage roles

Roles define what a user or service account can do within a realm or app.

### Create a realm role

Realm roles are global, and you can assign them to any user or group.
Use the following steps to create a realm role:

1. Log in to the Keycloak Admin Console.
2. From the sidebar, navigate to **Realm roles > Create role**.
3. In the **Role Name** field, enter a role name.
4. In the **Description** field, enter an optional description.
5. Click **Save**.
6. Optionally configure **Composite Roles** to bundle multiple permissions.

### Create a client role

Client roles are specific to an app and used for app-level authorizations.
Use the following steps to create client roles:

1. Log in to the Keycloak Admin Console.
2. From the sidebar, click **Clients** and select a previously created client.
3. Click the **Roles** tab.
4. Click **Create Role**.
5. In the **Role Name** field, enter a role name.
6. In the **Description** field, enter an optional description.
7. Click **Save**.

## Manage users

Managing users ensures that you can control access to NexusOne apps and maintain
security. In Keycloak, it allows you to create user accounts, manage credentials,
or enforce password policies.

### Create a new user

Use the following steps to create a new user:

1. Log in to the Keycloak Admin Console.
2. At the top left corner, select the realm you want to manage.
3. Navigate to **Users > Add user**.
4. Provide the required fields:
   * `Username` is mandatory
   * `Email`, `First Name`, and `Last Name` are optional
5. Click **Create**.
6. After creating a user, click the **Credentials** tab to set an initial password.
7. Choose whether the user should update their password on first login.

### Manage user credentials

Use the following steps to manage user credentials:

1. Log in to the Keycloak Admin Console.
2. From the sidebar, navigate to **Users > username > Credentials**.
   <Note>`username` is a user previously created</Note>
3. Within the credentials tab, you can do the following:
   * Reset passwords
   * Disable or enable credentials
   * Configure temporary or permanent passwords

### Assign a role to a user

Use the following steps to assign roles to users:

1. Log in to the Keycloak Admin Console.
2. From the sidebar, click **Users** and select a previously created user.
3. Navigate to **Role mappings > Assign role**.
4. In the available roles table, select a realm or client role you want to assign.
5. Click **Assign**.

## Manage groups

Groups allow administrators to combine multiple users and assign roles to them
easily.

### Create a group

Use the following steps to create a group:

1. Log in to the Keycloak Admin Console.
2. From the sidebar, navigate to **Groups > Create group** and assign roles or attributes to the group.
3. In the **Name** field, enter a group name.
4. Click **Create**.

### Add a user to a group

Use the following steps to add a user to a group:

1. Log in to the Keycloak Admin Console.
2. From the sidebar, click **Groups** and select a previously created group.
3. Navigate to **Members > Add member**.
4. In the available member table, select a user you want to add.
5. Click **Add**.

### Assign a role to a group

Use the following steps to assign a role to a group:

1. Log in to the Keycloak Admin Console.
2. From the sidebar, click **Groups** and select a previously created group.
3. Navigate to **Role mappings > Assign role**.
4. In the available roles table, select a realm or client role you want to assign.
5. Click **Assign**.

## Create a client

Clients represent NexusOne apps or services that rely on Keycloak for authentication
and authorization. These apps include, [Apache Airflow](/platform-components/apache-airflow/airflow-in-nx1),
[Superset](/platform-components/apache-superset/superset-in-nx1), or
[JupyterHub](/platform-components/jupyterhub).

Use the following steps to create a client:

1. Log in to the Keycloak Admin Console.
2. From the sidebar, navigate to **Clients > Create client**.
3. In the **Client type** field, select a client type such as OpenID Connect (OIDC)
   or Security Assertion Markup Language (SAML).
4. In the **Client ID** field, enter a client ID.
5. In the **Name** and **Description** field, optionally enter a name and description.
6. Click **Next**.
7. Select the authentication and authorization the client needs and click **Next**.
8. Optionally, enter URLs and URIs that define where the client runs and which endpoints
   Keycloak should redirect after authentication.
9. Click **Save**.

## Additional resources

* To get an overview of Keycloak, refer to the [Keycloak in NexusOne](./keycloak-in-nx1) page.
* For more details about Keycloak, refer to the [Keycloak](https://www.keycloak.org/documentation)
  official documentation.
* If you are using the NexusOne portal and want to learn how to configure IAM using Keycloak,
  refer to the [Govern](/documentation/govern/overview) page.