Keycloak

Configure syslog log forwarding for Keycloak.

Prerequisites

• Keycloak installed and running

• Radiant Security Agent installed and running

• Access to the Keycloak configuration file (keycloak.conf)

Add the data connector in Radiant Security

1. Log in to Radiant Security.

2. From the navigation menu, click Settings > Data Connectors and click + Add Connector.

3. Search for and select the Radiant Agent option and then click Data Feeds.

4. Under Select your data feeds, select Keycloak and click Credentials.

5. Under Credential Name, give your Radiant Agent integration an identifiable name (e.g. Radiant Agent Integration).

6. Click Add Connector.

Configure a local Radiant Security Agent

Refer to the Install the Radiant Security Agent guide to set up a local agent to collect the logs.

Before you begin the Configure log forwarding in Keycloak section, ensure you have the following information from your agent installation:

• The IP address or hostname of the server on which the agent is installed.

• The port configured for receiving Keycloak data.

Configure log forwarding in Keycloak

There are two options to configure log forwarding in Keycloak:

1. Configure the Keycloak configuration file (recommended)

2. Start Keycloak with the logging options

Configure the Keycloak configuration file

1. Access your Keycloak installation and navigate to the configuration file.

2. Add the following lines to your Keycloak configuration file (keycloak.conf):

Important note: Don't forget to replace the placeholder values for Radiant Agent IP (radiant-agent-ip ) and for port (radiant-agent-keycloak-port).

# Enable the syslog handler. Use log=console,syslog to enable both console and syslog.
log=syslog

# Set the syslog endpoint (IP and port)
log-syslog-endpoint=<radiant-agent-ip>:<radiant-agent-keycloak-port>

# Enable JSON output format
log-syslog-output=json

# Set the log level for specific categories
log-syslog-level=org.keycloak.events:INFO

1. Restart Keycloak.

Start Keycloak with the logging options

Optionally, you can start Keycloak with the following logging options:

bin/kc.sh start --log="console,syslog" --log-syslog-endpoint=<radiant-agent-ip>:<radiant-agent-keycloak-port> --log-syslog-output=json --log-syslog-level="org.keycloak.events:INFO"

For more information about the logging options, refer to the Keycloak documentation.