Create a local Keycloak user

To allow a user to log in to Perforce Unified Compliance using a local account managed in Keycloak, create the user in the unified-compliance realm and populate the required tenant-context profile fields.

The Perforce Unified Compliance app authenticates against the unified-compliance realm using Keycloak Organizations. A working user must live in that realm, belong to the tenant organization, and carry the tenant-context profile fields (domain, organizationId, tenant). Copy the tenant-specific values from an existing working user such as the admin user.

Before you begin

You need the following values. Copy them from an existing working user in the same tenant:

Field

Description

Source

Organization

The tenant's Keycloak Organization name

Keycloak admin console → Organizations

Group

The tenant's group name

Keycloak admin console → Groups

domain

The appliance FQDN

Copy from an existing user's Attributes tab

organizationId

The organization identifier

Copy from an existing user's Attributes tab

tenant

A JSON string containing the tenant UUID and metadata. Be sure to copy it verbatim.

Copy from an existing user's Attributes tab

Create the user

  1. Log in to Keycloak's admin console at https://<appliance-fqdn>/idp/admin/.

  2. Switch the realm dropdown (top-left) from master to unified-compliance. The app only authenticates against unified-compliance, do not use the master realm.

  3. In the left navigation, select Users > Add user. Fill in the following fields:

    • Username: the login name (for example, jsmith). Do not append an @tenant suffix.

    • Email

    • First name and Last name

    • Email verified: set to On

    • Domain, OrganizationId, and Tenant: fill these User profile fields with the values from the table above

    Select Create.

  4. Open the user, select the Credentials tab, then select Set password. Enter the password, set Temporary to Off, then select Save.

  5. In the left navigation, select Organizations > (your tenant organization) > Members > Add member, then select the user.

  6. Open the user, select the Groups tab, then select Join Group and select the tenant group.

  7. On the user's Details tab, confirm that domain, organizationId, and tenant are populated. If these fields are blank, the app will not resolve the tenant after login.

Verify the login

  1. Open https://<appliance-fqdn>/ in a new private or incognito browser window.

  2. Sign in with the exact username (for example, jsmith) or the full email address, and the password you set.

Troubleshooting

Symptom

Resolution

"Invalid username or password" error

Confirm the user is in the unified-compliance realm, not master. Type the exact username without an @tenant suffix. Use a fresh private or incognito window, an existing tab can replay a stale authentication session.

Login succeeds but the app shows no tenant or empty data

The tenant profile field is missing or incorrect. Copy the exact value verbatim from a working user's Attributes tab.