How do I use Keycloak with Azure Virtual Machines?

In this guide, we’ll walk through deploying Keycloak on Azure Virtual Machines. Keycloak is an open-source Identity and Access Management solution. We’ll create the necessary Azure resources such as a virtual network, storage account, and virtual machines, and then set up Keycloak on these VMs.

The resources created in this guide:

Azure Resource Group
Virtual Network
Subnet
Network Security Group
Public IP Address
Network Interface
Virtual Machine
Storage Account for Keycloak data

The following Terraform program defines and provisions these resources.

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const example = new azure.core.ResourceGroup("example", {
    name: "keycloak-rg",
    location: "West Europe",
});
const exampleVirtualNetwork = new azure.network.VirtualNetwork("example", {
    name: "keycloak-network",
    addressSpaces: ["10.0.0.0/16"],
    location: example.location,
    resourceGroupName: example.name,
});
const exampleSubnet = new azure.network.Subnet("example", {
    name: "keycloak-subnet",
    resourceGroupName: example.name,
    virtualNetworkName: exampleVirtualNetwork.name,
    addressPrefixes: ["10.0.1.0/24"],
});
const exampleNetworkSecurityGroup = new azure.network.NetworkSecurityGroup("example", {
    name: "keycloak-nsg",
    location: example.location,
    resourceGroupName: example.name,
    securityRules: [
        {
            name: "Allow_SSH",
            priority: 1001,
            direction: "Inbound",
            access: "Allow",
            protocol: "Tcp",
            sourcePortRange: "*",
            destinationPortRange: "22",
            sourceAddressPrefix: "*",
            destinationAddressPrefix: "*",
        },
        {
            name: "Allow_HTTP",
            priority: 1002,
            direction: "Inbound",
            access: "Allow",
            protocol: "Tcp",
            sourcePortRange: "*",
            destinationPortRange: "80",
            sourceAddressPrefix: "*",
            destinationAddressPrefix: "*",
        },
        {
            name: "Allow_Keycloak",
            priority: 1003,
            direction: "Inbound",
            access: "Allow",
            protocol: "Tcp",
            sourcePortRange: "*",
            destinationPortRange: "8080",
            sourceAddressPrefix: "*",
            destinationAddressPrefix: "*",
        },
    ],
});
const examplePublicIp = new azure.network.PublicIp("example", {
    name: "keycloak-ip",
    location: example.location,
    resourceGroupName: example.name,
    allocationMethod: "Dynamic",
});
const exampleNetworkInterface = new azure.network.NetworkInterface("example", {
    name: "keycloak-nic",
    location: example.location,
    resourceGroupName: example.name,
    ipConfigurations: [{
        name: "internal",
        subnetId: exampleSubnet.id,
        privateIpAddressAllocation: "Dynamic",
        publicIpAddressId: examplePublicIp.id,
    }],
});
const exampleVirtualMachine = new azure.compute.VirtualMachine("example", {
    name: "keycloak-vm",
    location: example.location,
    resourceGroupName: example.name,
    networkInterfaceIds: [exampleNetworkInterface.id],
    vmSize: "Standard_DS1_v2",
    storageOsDisk: {
        name: "keycloak_os_disk",
        caching: "ReadWrite",
        createOption: "FromImage",
        managedDiskType: "Standard_LRS",
    },
    storageImageReference: {
        publisher: "Canonical",
        offer: "UbuntuServer",
        sku: "18.04-LTS",
        version: "latest",
    },
    osProfile: {
        computerName: "hostname",
        adminUsername: "adminuser",
        adminPassword: "ultra_secure_password123!",
    },
    osProfileLinuxConfig: {
        disablePasswordAuthentication: false,
    },
});
const exampleAccount = new azure.storage.Account("example", {
    name: "keycloakstorage",
    resourceGroupName: example.name,
    location: example.location,
    accountTier: "Standard",
    accountReplicationType: "LRS",
});
export const publicIp = examplePublicIp.ipAddress;

Key Points:

Create an Azure resource group to hold all the resources.
Set up a virtual network and subnet to ensure connectivity.
Configure a network security group to manage traffic rules.
Allocate a dynamic public IP for internet access.
Provision a network interface associated with the public IP.
Create an Azure virtual machine with necessary configurations.
Include a storage account for Keycloak data persistence.

Summary

This example provided a step-by-step approach for deploying Keycloak on an Azure VM, creating network configurations, and securing access through network security groups. Use the outputted IP address to access your Keycloak instance.

Deploy this code

Want to deploy this code? Sign up for a free Pulumi account to deploy in a few clicks.

New to Pulumi?

Want to deploy this code? Sign up with Pulumi to deploy in a few clicks.