> For the complete documentation index, see [llms.txt](https://help.radiantsecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.radiantsecurity.ai/radiant-connectors/identity-and-access/keycloak.md).

# Keycloak

Keycloak is an open-source identity and access management (IAM) platform that controls authentication, single sign-on, and authorization for applications and services. Connecting Keycloak forwards authentication activity to Radiant Security through the Radiant Agent over syslog. Radiant uses this activity during AI triage, giving analysts the identity context to separate routine access from suspicious sign-in activity.

### Prerequisites

* [ ] A running Keycloak deployment
* [ ] Access to the Keycloak configuration file (`keycloak.conf`)
* [ ] A deployed [Radiant Agent](https://help.radiantsecurity.ai/radiant-connectors/ingestion-methods/install-the-radiant-security-agent) reachable from Keycloak

### Add the data connector in Radiant Security

1. Log in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, click **Settings** > **Data Connectors**, then click **+ Add Connector**.
3. Search for and select **Radiant Agent**, then click **Data Feeds**.
4. Under **Select your data feeds**, select **Keycloak**, then click **Credentials**.
5. Under **Credential Name**, enter an identifiable name for the Radiant Agent integration (e.g., `Radiant Agent integration`).
6. Click **Add Connector**.

### Configure log forwarding in Keycloak

Before starting, confirm the IP address of the Radiant Agent and the port configured to receive Keycloak data. If you do not know the port, contact your Customer Success representative.

Use either method below to forward Keycloak logs to the Radiant Agent.

#### **Edit the Keycloak configuration file (recommended)**

1. On the Keycloak server, open the configuration file (`keycloak.conf`).
2. Add the following lines, replacing `<radiant-agent-ip>` and `<radiant-agent-keycloak-port>` with the IP address and port of the Radiant Agent:

{% code overflow="wrap" %}

```bash
# Enable the syslog handler. Use log=console,syslog to enable both console and syslog.
log=syslog

# Set the syslog endpoint (IP and port)
log-syslog-endpoint=:

# Enable JSON output format
log-syslog-output=json

# Set the log level for specific categories
log-syslog-level=org.keycloak.events:INFO
```

{% endcode %}

3. Restart Keycloak.

#### **Start Keycloak with logging options**

Alternatively, pass the logging options when you start Keycloak:

{% code overflow="wrap" %}

```bash
bin/kc.sh start --log="console,syslog" --log-syslog-endpoint=: --log-syslog-output=json --log-syslog-level="org.keycloak.events:INFO"
```

{% endcode %}

For more information about the logging options, refer to the [Keycloak documentation](https://www.keycloak.org/server/logging#_centralized_logging_using_syslog).

#### Verify ingestion

After Keycloak begins forwarding, confirm events are reaching Radiant.

1. In Radiant, navigate to [Log Management](https://app.radiantsecurity.ai/logs).
2. Filter by `rs_connectorType:"keycloak"`.
3. Confirm recent events appear.

{% hint style="info" %}
Allow several minutes for events to be parsed, indexed, and available for search.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.radiantsecurity.ai/radiant-connectors/identity-and-access/keycloak.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.