Before You Begin

Review the access requirements and example values used to configure Keycloak for application-mediated access.

Ensure that you have the following:

• Access to a Keycloak realm with permission to configure clients, client scopes, protocol mappers, users, and role assignments.

• The realm issuer URL and its JSON Web Key Set (JWKS) endpoint. The database retrieves public signing keys from this endpoint to verify tokens.

• A client identifier to use when registering ORDS in Keycloak and an audience value that identifies the database.

The examples in this chapter use the following values. Replace them with values for your environment.

Item	Example value
Realm	deepsec
Issuer	https://keycloak.example.com/realms/deepsec
JWKS endpoint	https://keycloak.example.com/realms/deepsec/protocol/openid-connect/certs
Application client ID	ords_client
Database audience	db_app
End-user name claim	preferred_username
Unique user identifier claim	sub
Application identifier claim	client_id
Role claim	roles