+ Click here to show the bash script
+
+[source, bash]
+----
+#!/bin/bash
+
+# --- Configuration Variables ---
+# The path to your kcadm.sh script.
+KCADM_PATH="Path/to/kcadm.sh" # ---> 1
+
+# Keycloak server connection details
+KEYCLOAK_URL="" # ---> 2
+KEYCLOAK_ADMIN="" # ---> 3
+KEYCLOAK_ADMIN_PASSWORD="" # ---> 4
+
+# Realm settings
+REALM="trust"
+
+# Role name
+TRUSTD_ROLE_NAME="trustd"
+
+# Admin username
+TRUSTED_ADMIN_USERNAME="admin" # ---> 5
+# Admin user password
+TRUSTED_ADMIN_PASSWORD="admin123456" # ---> 6
+
+# Directory containing client JSON files
+INIT_DATA="/path/to/client/json/" # ---> 7
+
+CLIENTS=("cli" "frontend")
+
+# Exit on interrupt
+trap break INT
+
+while ! "$KCADM_PATH" config credentials --server "$KEYCLOAK_URL" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" &> /dev/null; do
+ echo "Waiting for Keycloak to start up..."
+ sleep 5
+done
+
+echo "Keycloak ready"
+
+# Create/update realm
+REALM_OPTS=()
+REALM_OPTS+=(-s enabled=true)
+REALM_OPTS+=(-s "displayName=Trusted Content")
+REALM_OPTS+=(-s registrationAllowed=true)
+REALM_OPTS+=(-s resetPasswordAllowed=true)
+REALM_OPTS+=(-s loginWithEmailAllowed=false)
+
+if "$KCADM_PATH" get "realms/${REALM}" &> /dev/null; then
+ # exists -> update
+ "$KCADM_PATH" update "realms/${REALM}" "${REALM_OPTS[@]}"
+else
+ # need to create
+ "$KCADM_PATH" create realms -s "realm=${REALM}" "${REALM_OPTS[@]}"
+fi
+
+# Create realm roles
+"$KCADM_PATH" create roles -r "$REALM" -s name="$TRUSTD_ROLE_NAME" || true
+# add TRUSTD_ROLE_NAME as default role
+"$KCADM_PATH" add-roles -r "$REALM" --rname "default-roles-${REALM}" --rolename "$TRUSTD_ROLE_NAME"
+
+MANAGER_ID=$("$KCADM_PATH" get roles -r "$REALM" --fields id,name --format csv --noquotes | grep ",$TRUSTD_ROLE_NAME" | awk -F ',' '{print $1}')
+
+# Create scopes
+# shellcheck disable=SC2043
+for i in read:document; do
+ "$KCADM_PATH" create client-scopes -r "$REALM" -s "name=$i" -s protocol=openid-connect || true
+done
+
+for i in create:document update:document delete:document; do
+ "$KCADM_PATH" create client-scopes -r "$REALM" -s "name=$i" -s protocol=openid-connect || true
+ ID=$("$KCADM_PATH" get client-scopes -r "$REALM" --fields id,name --format csv --noquotes | grep ",${i}" | awk -F ',' '{print $1}')
+ # add all scopes to the TRUSTD_ROLE_NAME role
+ "$KCADM_PATH" create "client-scopes/${ID}/scope-mappings/realm" -r "$REALM" -b '[{"name":"$TRUSTD_ROLE_NAME", "id":"'"${MANAGER_ID}"'"}]' || true
+done
+
+# Create and configure the cli client
+for client in "${CLIENTS[@]}"; do
+ ID=$("$KCADM_PATH" get clients -r "$REALM" --query exact=true --query "clientId=${client}" --fields id --format csv --noquotes)
+ CLIENT_OPTS=()
+ if [[ -n "$ID" ]]; then
+ # TODO: replace with update once https://github.com/keycloak/keycloak/issues/12484 is fixed
+ "$KCADM_PATH" delete "clients/${ID}" -r "$REALM"
+ "$KCADM_PATH" create clients -r "$REALM" -f "${INIT_DATA}/client-${client}.json" "${CLIENT_OPTS[@]}"
+ else
+ "$KCADM_PATH" create clients -r "$REALM" -f "${INIT_DATA}/client-${client}.json" "${CLIENT_OPTS[@]}"
+ fi
+ # now set the client-secret
+ ID=$("$KCADM_PATH" get clients -r "$REALM" --query exact=true --query "clientId=${client}" --fields id --format csv --noquotes)
+ if [ "${client}" == "cli" ]; then
+ "$KCADM_PATH" add-roles -r "$REALM" --uusername service-account-${client} --rolename "$TRUSTD_ROLE_NAME"
+ fi
+done
+# Create user
+ID=$("$KCADM_PATH" get users -r "$REALM" --query exact=true --query "username=$TRUSTED_ADMIN_USERNAME" --fields id --format csv --noquotes)
+# the next check might seem weird, but that's just Keycloak reporting a "user not found" in two different ways
+if [[ -n "$ID" && "$ID" != "[]" ]]; then
+ "$KCADM_PATH" update "users/$ID" -r "$REALM" -s enabled=true
+else
+ "$KCADM_PATH" create users -r "$REALM" -s "username=$TRUSTED_ADMIN_USERNAME" -s enabled=true -s email=test@example.com -s emailVerified=true -s firstName=Admin -s lastName=Admin
+fi
+
+# set role
+"$KCADM_PATH" add-roles -r "$REALM" --uusername "$TRUSTED_ADMIN_USERNAME" --rolename "$TRUSTD_ROLE_NAME"
+
+# set password
+ID=$("$KCADM_PATH" get users -r "$REALM" --query exact=true --query "username=$TRUSTED_ADMIN_USERNAME" --fields id --format csv --noquotes)
+"$KCADM_PATH" update "users/${ID}/reset-password" -r "$REALM" -s type=password -s "value=${TRUSTED_ADMIN_PASSWORD}" -s temporary=false -n
+
+echo Keycloak initialization complete
+----
+
+
+++++
++
+**References:**
++
+. _KCADM_PATH:_ Update the KCADM path from <<_keycloak_bin_download, downaloded>> directory
+. _KEYCLOAK_URL:_ Keycloak URL from <<_keycloak_usage_,operator>>
+. _KEYCLOAK_ADMIN:_ Keycloak ADMIN username from <<_keycloak_usage_,operator>>
+. _KEYCLOAK_ADMIN_PASSWORD:_ Keycloak ADMIN password from <<_keycloak_usage_,operator>>
+. _TRUSTED_ADMIN_USERNAME:_ RHTPA application admin username. By default `admin`
+. _TRUSTED_ADMIN_PASSWORD:_ RHTPA application admin password. By default `admin123456`
+. _INIT_DATA:_ Location of keycloak <<_keycloak_clients,clients>> json files
[[_frontend_redirect_uris]]
-==== Configure Frontend Redirect URIs
-
- * Navigate to the **Clients** section and select the `frontend` client that you imported in <<_client_import,Client Import>>.
- * In the **Valid Redirect URIs** field, add the application URL that will be used after the Helm installation which is `https://server{appDomain}`.
+===== Configure Frontend Redirect URIs
+ * Navigate Keycloak admin console. Go to the **Clients** section and select the `frontend` client imported in <<_client_import,Client Import>>.
+ * Add the application URL to the **Valid Redirect URIs** field, Which is `https://server{appDomain}`. For example, `https://server-tpa.apps.ocp.cluster.net`
+
[NOTE]
Failure to update this field will result in a redirect URI error during application login.
==== Usage
-For the RHTPA installation, the following OIDC values are retrieved from your Keycloak (RH-SSO) configuration:
+For the RHTPA installation, the following OIDC values are retrieved from your Keycloak configuration:
-* **issuerURL**: `_keycloakURL_/realms/<<_realm_creation,Realm name>>`
+* **issuerURL**: `_keycloakURL_/realms/_