Keycloak SSO

Fri, 03 Jul 2026 00:00:00 +0000

Install tools

Update profile

~/.ksso_config.toml

Create this file locally with the following content:

[sso]
sso_domain = "https://keycloak.saritasa.cloud"
sso_realm = "saritasa"
sso_agent_port = 8201

~/.aws/config

Update locally:

Make sure to set a full path for the **--config** option, don't use **~**, as it's not expanded inside credential_process.

Devops

[profile igaawi/keycloak/administrators]
region=us-west-2
credential_process=ksso login --json --client-id igaawi-aws-devops --aws-role-arn arn:aws:iam::187528943262:role/igaawi-prod-keycloak-sso-administrators-role 2>/dev/null | sed -n "/^{/,\$p"

Developers

[profile igaawi/keycloak/developers]
region=us-west-2
credential_process=ksso login --json --client-id igaawi-aws-developers --aws-role-arn arn:aws:iam::187528943262:role/igaawi-prod-keycloak-sso-developers-role 2>/dev/null | sed -n "/^{/,\$p"

Authenticate into aws

Execute single shell command

This will provide short-term cached AWS credentials for a single invocation of the command.

Sso on IGAAWI docs