Keycloak integration

Keycloak uses the package’s shared OIDC integration; this page is a provider checklist, not a second configuration reference.

• Register a confidential client for the chart’s authorization-code flow. Set the exact Kibana callback https://<kibana-host>/api/security/oidc/callback and the configured logout redirect, rather than an unrestricted wildcard redirect.
• Use the realm’s discovery document for the issuer and endpoints. Do not assume an /auth prefix: it depends on the Keycloak deployment’s relative path.
• Release the principal, group, and email claims selected by the package settings, and request only scopes supported by that realm. Group membership is not itself an Elasticsearch role assignment.
• Store the client secret in encrypted/managed values. Confirm CA trust and Elasticsearch egress to Keycloak, including every endpoint in discovery.
• Establish least-privilege Elasticsearch role mappings scoped to the intended realm and groups. Do not map every user or group to superuser. Retain basic authentication until OIDC authorization and recovery access are validated.

For Keycloak client and mapper procedures, use the version-compatible Keycloak administration guide for your identity-provider deployment. The workload chart does not configure the provider.