Merge pull request #3362 from pareenaverma/content_review

Tech review of Keycloak LP

Author: pareenaverma

content/learning-paths/servers-and-cloud-computing/keycloak-cobalt/_index.md

@@ -28,7 +28,7 @@ author: Pareena Verma
 
 ### Tags
 skilllevels: Introductory
-subjects: Containers and Virtualization
+subjects: Web
 cloud_service_providers:
   - Microsoft Azure
 

content/learning-paths/servers-and-cloud-computing/keycloak-cobalt/background.md

@@ -33,14 +33,9 @@ Keycloak integrates with web applications, APIs, Kubernetes platforms, microserv
 
 To learn more, see the official [Keycloak documentation](https://www.keycloak.org/documentation).
 
-Keycloak provides several important capabilities for authentication and security management:
-
-- Single Sign-On (SSO): Enables users to authenticate once and access multiple applications securely.
-- Centralized Identity Management: Manages users, roles, groups, and authentication policies from a single platform.
-- OAuth2 and OpenID Connect Support: Simplifies secure API and application authentication workflows.
-- Multi-factor Authentication (MFA): Improves account security using additional authentication methods.
-- User Federation: Integrates with enterprise identity systems such as LDAP and Active Directory.
-- Role-Based Access Control (RBAC): Controls user permissions and application access securely.
+Keycloak provides several important capabilities for authentication and security management. Its Single Sign-On (SSO) support lets users authenticate once and access multiple applications without logging in again. Centralized Identity Management means you can manage users, roles, groups, and authentication policies from a single platform, while OAuth2 and OpenID Connect support simplifies secure API and application authentication workflows.
+
+Keycloak also supports Multi-factor Authentication (MFA) for stronger account security, User Federation for integrating with enterprise identity systems such as LDAP and Active Directory, and Role-Based Access Control (RBAC) to control user permissions and application access.
 
 In this Learning Path, you'll deploy Keycloak on an Azure Cobalt 100 Arm64 virtual machine and configure PostgreSQL as the backend database. You'll create realms, users, and OAuth2/OpenID Connect clients, then integrate a Flask application with Keycloak authentication.
 

content/learning-paths/servers-and-cloud-computing/keycloak-cobalt/instance.md

@@ -59,6 +59,16 @@ Your virtual machine should be ready and running in a few minutes. You can SSH i
 
 {{% notice Note %}}To learn more about Arm-based virtual machines in Azure, see "Getting Started with Microsoft Azure" in [Get started with Arm-based cloud instances](/learning-paths/servers-and-cloud-computing/csp/azure/).{{% /notice %}}
 
+### Connect to your virtual machine
+
+Use the private key file you downloaded and the public IP address shown in the Azure portal to connect to your virtual machine.
+
+```bash
+ssh -i <your-key-name>.pem azureuser@YOUR_PUBLIC_IP
+```
+
+Replace `<your-key-name>` with the name of your SSH key pair and `YOUR_PUBLIC_IP` with the public IP address shown in the Azure portal after deployment.
+
 ## What you've accomplished and what's next
 
 You've created an Azure Cobalt 100 Arm64 virtual machine running Ubuntu 24.04 LTS with SSH authentication configured. The virtual machine is now ready for installing PostgreSQL, Keycloak, and the Flask OAuth2 demo application.

content/learning-paths/servers-and-cloud-computing/keycloak-cobalt/keycloak_deployment_azure_cobalt100.md

@@ -12,52 +12,7 @@ In this section, you'll install Keycloak on an Azure Cobalt 100 Arm64 virtual ma
 
 Keycloak provides centralized identity and access management for applications using standards such as OAuth2, OpenID Connect, and SAML.
 
-### Overview
-
-This learning path explains how to deploy and configure Keycloak on Azure Cobalt 100 Arm64 virtual machines using PostgreSQL as the backend database.
-
-You will learn how to:
-
-- Install Keycloak on Arm64 infrastructure
-- Configure PostgreSQL integration
-- Bootstrap the Keycloak admin user
-- Configure Keycloak as a systemd service
-- Fix common Keycloak 26.x issues
-- Access the Keycloak administration console
-
-### Target platform
-
-| Component      | Value                         |
-| -------------- | ----------------------------- |
-| Cloud          | Microsoft Azure               |
-| VM Type        | Azure Cobalt 100 Arm64        |
-| Recommended VM | Standard_D4ps_v6              |
-| OS             | Ubuntu Server 24.04 LTS Arm64 |
-
-### Architecture
-
-```text
-Azure Cobalt 100 Arm64 VM
-        |
-        ├── PostgreSQL
-        ├── Keycloak
-        ├── Flask OAuth Demo App
-        └── Browser Access
-```
-
-### Configure Azure networking
-
-Allow these inbound ports:
-
-| Port | Purpose                      |
-| ---- | ---------------------------- |
-| 22   | SSH                          |
-| 8080 | Keycloak HTTP                |
-| 9000 | Keycloak management endpoint |
-| 5000 | Flask demo application       |
-
-
-### Update your system
+## Update your system
 
 Start by updating the package index and installing the latest available package updates on the virtual machine.
 
@@ -90,11 +45,14 @@ java -version
 
 The output is similar to:
 ```output
-openjdk version "21"
+openjdk version "21.0.11" 2026-04-21
+OpenJDK Runtime Environment (build 21.0.11+10-1-24.04.2-Ubuntu)
+OpenJDK 64-Bit Server VM (build 21.0.11+10-1-24.04.2-Ubuntu, mixed mode, sharing)
 ```
 
 
-### Configure PostgreSQL Database 
+## Configure PostgreSQL database
+
 Keycloak needs a persistent database to store realms, users, clients, roles, and authentication configuration.
 
 ### Create the Keycloak database and user
@@ -122,7 +80,7 @@ Grant database access to the Keycloak user.
 GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloakuser;
 ```
 
-Connect to Keycloak database:
+Connect to the Keycloak database.
 
 ```sql
 \c keycloak
@@ -137,14 +95,19 @@ GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO keycloakuser;
 GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO keycloakuser;
 ```
 
-Exit PostgreSQL:
+Exit PostgreSQL.
 
 ```sql
 \q
 ```
 
-### Download Keycloak
-Download the Keycloak release archive, extract it, and move it to /opt/keycloak.
+## Download Keycloak
+
+Download the Keycloak release archive, extract it, and move it to `/opt/keycloak`.
+
+{{% notice Note %}}
+The following commands use Keycloak version 26.2.5. The same commands work with other versions. Replace the file names in these steps with the file for your version of choice. To find the latest version, see [Keycloak releases on GitHub](https://github.com/keycloak/keycloak/releases).
+{{% /notice %}}
 
 ```bash
 cd ~
@@ -153,19 +116,25 @@ tar -xzf keycloak-26.2.5.tar.gz
 sudo mv keycloak-26.2.5 /opt/keycloak
 ```
 
-### Create Keycloak Linux user
+## Create Keycloak Linux user
+
 Create a dedicated Linux user to run Keycloak securely as a system service.
 
 ```bash
 sudo useradd -r -s /bin/false keycloak
 sudo chown -R keycloak:keycloak /opt/keycloak
 ```
 
-### Configure Keycloak
+## Configure Keycloak
+
 Create the Keycloak configuration file and connect it to the PostgreSQL database.
 
 Replace YOUR_PUBLIC_IP with the public IP address of your Azure VM.
 
+{{% notice Note %}}
+The `db-password` value must match the password you set for `keycloakuser` during the PostgreSQL setup step. Replace `StrongPassword123!` with your actual database password.
+{{% /notice %}}
+
 Create configuration:
 
 ```bash
@@ -190,15 +159,15 @@ EOF
 Do not use proxy=edge with this setup because it can cause hostname and admin console loading issues in newer Keycloak versions.
 {{% /notice %}}
 
-### Build the Keycloak server
+## Build the Keycloak server
 
 Build Keycloak so the server configuration is optimized and persisted before startup.
 
 ```bash
 sudo /opt/keycloak/bin/kc.sh build
 ```
 
-### Create the Keycloak admin user
+## Create the Keycloak admin user
 
 Bootstrap the initial admin user that will be used to log in to the Keycloak Admin Console.
 
@@ -229,7 +198,7 @@ Successful output includes:
 Created temporary admin user with username admin
 ```
 
-### Configure Keycloak as a systemd service
+## Configure Keycloak as a systemd service
 
 Create a systemd service so Keycloak starts automatically and runs in the background.
 
@@ -254,7 +223,7 @@ WantedBy=multi-user.target
 EOF
 ```
 
-### Configure Keycloak runtime directories
+## Configure Keycloak runtime directories
 
 Create writable runtime directories required by Keycloak for temporary files, logs, and cache.
 
@@ -277,10 +246,9 @@ sudo chmod -R 755 /opt/keycloak/data
 ```
 
 
-### Start and verify Keycloak
-Start Keycloak and verify that the service is running correctly.
+## Start and verify Keycloak
 
-Start Keycloak:
+Start Keycloak and verify that the service is running correctly.
 
 Reload systemd, enable the service, and start Keycloak.
 ```bash
@@ -294,15 +262,29 @@ Check the service status.
 ```bash
 sudo systemctl status keycloak
 ```
+The output should look similar to:
 
-View live Keycloak logs.
+```output
+   Active: active (running) since Thu 2026-06-04 15:26:27 UTC; 7s ago
+```
+
+View live Keycloak logs to confirm it starts without errors, then press Ctrl+C to exit.
 
 ```bash
 sudo journalctl -u keycloak -f
 ```
 
 
+## Access the Keycloak Admin Console
+
+Open the Keycloak Admin Console in your browser.
+
+```text
+http://YOUR_PUBLIC_IP:8080/admin/
+```
+
 ### Fix HTTPS required error
+
 If the browser shows an HTTPS required message, disable SSL enforcement for the master realm for this HTTP-based learning path setup.
 
 ```text
@@ -331,23 +313,17 @@ Exit PostgreSQL.
 \q
 ```
 
-Restart Keycloak:
+Restart Keycloak.
 
 ```bash
 sudo systemctl restart keycloak
 ```
 
-### Access the Keycloak Admin Console
-
-Open the Keycloak Admin Console in your browser.
-
-```text
-http://YOUR_PUBLIC_IP:8080/admin/
-```
+After restarting, open the admin console again and log in.
 
 ![Keycloak login page running on the Azure Cobalt 100 Arm64 virtual machine after fixing the HTTPS required issue and successfully loading the authentication screen.#center](images/keycloak-ui.png "Keycloak login page on Azure Cobalt 100 Arm64")
 
-Login:
+Log in with the admin credentials you created earlier.
 
 ```text
 Username: admin
@@ -356,7 +332,7 @@ Password: AdminPassword123!
 
 ![Keycloak Admin Console welcome page showing the master realm dashboard after successful login on the Azure Cobalt 100 Arm64 virtual machine.#center](images/keycloak-welcome-page.png "Keycloak Admin Console welcome dashboard")
 
-### Verify health endpoint
+## Verify health endpoint
 
 ```bash
 curl http://localhost:9000/health
@@ -365,11 +341,19 @@ curl http://localhost:9000/health
 The output is similar to:
 
 ```output
-{"status":"UP"}
+{
+    "status": "UP",
+    "checks": [
+        {
+            "name": "Keycloak database connections async health check",
+            "status": "UP"
+        }
+    ]
+}
 ```
 
-### What you've learned and what's next
+## What you've learned and what's next
 
 You now have Keycloak running successfully on Azure Cobalt 100 Arm64 with PostgreSQL integration, a systemd service, and a working admin console.
 
-Next, you'll configure a Flask application and integrate it with Keycloak using OAuth2/OpenID Connect authenticatio
+Next, you'll configure a Flask application and integrate it with Keycloak using OAuth2/OpenID Connect authentication.