Skip to content

  Keycloak 26.7.0

Updated: 06 August 2026

Keycloak 26.7.0 on Ubuntu 24.04 LTS Minimal

AMI: ami-0b1370e4c2962630e (us-east-1) · Keycloak 26.7.0 · Ubuntu 24.04 LTS minimal · OpenJDK 21 (default-jre-headless)

Introduction

A ready-to-run Keycloak 26.7.0 identity and access management server on Ubuntu 24.04 LTS minimal, secured with key-only SSH and auto-generated admin credentials. Built for DevOps engineers and system integrators who need SAML/OIDC authentication, MFA, user federation, and SSO testing or integration without a multi-hour install.

What you get:

  • Keycloak 26.7.0 running as a systemd service under a dedicated non-login keycloak user
  • OpenJDK 21 (default-jre-headless) with automatic security updates via unattended-upgrades
  • HTTPS admin console on port 8443 with an auto-generated self-signed certificate (replace with a CA-signed cert for production)
  • Random admin credentials generated on first boot, stored in /etc/keycloak/.admin-credentials (root-readable only)
  • H2 embedded database out of the box; PostgreSQL-ready via environment variables

Hourly Marketplace product (standard rate card). Recommended instance type: t3.medium (2 vCPU, 4 GiB RAM) or larger.

Quickstart

Get from AMI to admin console in about five minutes.

  1. Launch the epoksystems-keycloak-2670-ubuntu-minimal AMI (us-east-1) on a t3.medium (or larger) instance.
  2. Attach a key pair.
  3. In the security group, allow 22/tcp and 8443/tcp from your IP.
  4. SSH in as ubuntu:
ssh -i <key.pem> ubuntu@<public-ip>
  1. Confirm Keycloak is running:
systemctl is-active keycloak
# active
  1. Retrieve the auto-generated admin password:
sudo cat /etc/keycloak/.admin-credentials
# KEYCLOAK_ADMIN=admin
# KEYCLOAK_ADMIN_PASSWORD=<random>
  1. Open the admin console at https://<public-ip>:8443. The certificate is self-signed, so accept the browser warning, then sign in as admin with the password from step 4.
  2. Health check from the instance (the management endpoint is HTTPS-only):
curl -k https://127.0.0.1:9000/health
# {"status":"UP", ...}

The AMI boots and Keycloak serves within 60 seconds.

Architecture

What's installed

Component Detail
Keycloak 26.7.0 binary distribution in /opt/keycloak
Java OpenJDK 21 (default-jre-headless, the Ubuntu 24.04 default; Keycloak requires 17+)
Database H2 embedded by default (dev/test). PostgreSQL is not pre-installed — see Production database
OS Ubuntu 24.04 LTS minimal, automatic security updates enabled (unattended-upgrades)

Services

  • keycloak.service — the Keycloak server (systemd, runs as the keycloak user).
  • keycloak-firstboot.service — one-shot; generates the self-signed TLS certificate and random admin credentials on first boot.

Configuration files

File Purpose
/opt/keycloak/conf/keycloak.conf Keycloak server configuration
/opt/keycloak/conf/certs/server.crt.pem Self-signed TLS certificate (port 8443)
/opt/keycloak/conf/certs/server.key.pem Private key for the TLS certificate
/etc/keycloak/env.conf Environment variables injected into the service (credentials, database)
/etc/keycloak/.admin-credentials Auto-generated admin credentials (mode 0400, root:root)
/etc/systemd/system/keycloak.service Systemd unit

Network exposure

Port Listener Reachable from
22/tcp SSH (key-only) 0.0.0.0/0
8443/tcp HTTPS admin console 0.0.0.0/0
8080/tcp HTTP RFC 1918 only (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
9000/tcp Management / health (HTTPS-only) RFC 1918 only

Configuration

Admin credentials

Credentials are generated at first boot by keycloak-firstboot.service and written to /etc/keycloak/.admin-credentials (root-readable only):

sudo cat /etc/keycloak/.admin-credentials

They are also logged to the systemd journal (journalctl -u keycloak-firstboot.service).

To set your own credentials, pass them as user-data environment variables at launch time. They are picked up via /etc/keycloak/env.conf:

# user-data
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=your-strong-password

These are mapped to Keycloak's bootstrap settings (KC_BOOTSTRAP_ADMIN_USERNAME / KC_BOOTSTRAP_ADMIN_PASSWORD). If they are present at first boot, the auto-generated values are skipped.

For production, move admin and database secrets to AWS Secrets Manager and stop storing them on the instance.

Production database (PostgreSQL)

Out of the box the AMI uses H2 embedded — fine for dev/test, not for production. PostgreSQL is intentionally not pre-installed; point Keycloak at your own PostgreSQL instance (RDS, etc.) via /etc/keycloak/env.conf:

# /etc/keycloak/env.conf (example — adjust to your setup)
KC_DB=postgres
KC_DB_URL=jdbc:postgresql://<db-host>:5432/keycloak
KC_DB_USERNAME=keycloak
KC_DB_PASSWORD=<db-password>

Then restart the service:

sudo systemctl restart keycloak

Alternatively, set the same values in /opt/keycloak/conf/keycloak.conf (db=postgres, db-url=..., db-username=..., db-password=...). See the official database guide.

Replacing the self-signed TLS certificate

The bundled certificate is self-signed and generated at first boot — the browser will warn until you replace it.

  1. Place your CA-signed certificate and key at:
  2. /opt/keycloak/conf/certs/server.crt.pem
  3. /opt/keycloak/conf/certs/server.key.pem
  4. Fix ownership and permissions:
sudo chown keycloak:keycloak /opt/keycloak/conf/certs/server.crt.pem /opt/keycloak/conf/certs/server.key.pem
sudo chmod 600 /opt/keycloak/conf/certs/server.key.pem
  1. Restart Keycloak:
sudo systemctl restart keycloak

Management / health endpoint (port 9000)

Keycloak 26's management interface is HTTPS-only. It listens on port 9000 and is restricted to RFC 1918 addresses, so run health checks from inside the instance (or via a bastion/VPC):

curl -k https://127.0.0.1:9000/health

The endpoint answers HTTP 200 with a JSON status payload when healthy.

Restricting the HTTP listener (port 8080)

The plain-HTTP listener on 8080 is already bound to localhost and RFC 1918 addresses only — it is not exposed to the internet. To disable it entirely, remove/comment the http-enabled=true line in /opt/keycloak/conf/keycloak.conf and restart:

sudo systemctl restart keycloak

Troubleshooting / FAQ

"I can't reach the admin console on 8443." Check the security group: it must allow 8443/tcp from your IP. Then SSH in and confirm the service is up: systemctl is-active keycloak. If it is down, journalctl -u keycloak will show why.

"Why is my port blocked?" Ports 8080 and 9000 are intentionally restricted to RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) — they are not reachable from the public internet. Only 22 and 8443 are public. If a tool still cannot connect, verify the security group inbound rules.

"The browser shows a certificate warning." The AMI ships with a self-signed certificate generated at first boot. Accept the warning for testing, or replace the certificate with a CA-signed one (see above).

"Health check on 9000 fails with a connection error over HTTP." The management endpoint is HTTPS-only in Keycloak 26. Use curl -k https://127.0.0.1:9000/health from the instance — plain http:// will not work.

"The admin console root returns a 302." That is normal: https://host:8443/ redirects to the console path. Follow the redirect (or use curl -L -k).

"What Java version is on the AMI?" OpenJDK 21 via default-jre-headless (the Ubuntu 24.04 default). Keycloak 26.7.0 requires Java 17+, so this is fully supported and receives security updates via apt.

"Is this image CIS-hardened?" No. This image follows the base Ubuntu 24.04 minimal posture: key-only SSH, root login disabled, dedicated non-login service user, restricted management/HTTP listeners, auto-generated credentials, and automatic security updates. Full CIS benchmarking is not applied on this product.

"Where is PostgreSQL?" Not installed — by design. The AMI uses H2 embedded for dev/test. For production, point Keycloak at your own PostgreSQL instance (see Production database).

Official documentation

For everything else, see the official Keycloak documentation: https://www.keycloak.org/documentation