Users, Groups & Credentials
What this module covers
Section titled “What this module covers”Keycloak keeps a clear separation between who someone is (their identity), how they prove it (credentials), and what they are allowed to do (roles and permissions). This module focuses on the identity side of that equation.
By the end of this module you will know how to create and manage users, organise them into groups, assign and reset credentials, and drive users through required actions — all inside the Keycloak admin console and via the Admin REST API.
Module lessons
Section titled “Module lessons”| Order | Lesson | What you will learn |
|---|---|---|
| 1 | Users | Create users, manage attributes, enable or disable accounts, verify email |
| 2 | Groups | Create group hierarchies, add users to groups, inherit roles through group membership |
| 3 | Credentials | Set passwords, reset credentials, configure OTP, understand credential priority |
| 4 | Required Actions | Assign built-in actions (verify email, update password, configure OTP), create custom actions |
| 5 | User Federation | Connect an LDAP or Active Directory server, configure mappers, sync users on demand |
How the pieces fit together
Section titled “How the pieces fit together”A user is a record stored inside a realm. The realm is the boundary — users in realm my-app cannot log in to realm other-app unless their account exists there too.
Groups let you bundle users so you can manage role assignments, attributes, and required actions in one place rather than per-user. Groups can be nested into a hierarchy.
Credentials are the secrets or second factors a user presents to prove their identity. Keycloak supports passwords, OTP codes, passkeys, and more. Each credential type has its own priority and lifecycle.
Required actions are tasks Keycloak forces a user to complete before they can fully log in — for example, verifying their email address or setting a new password after an admin reset.