Phase 2: Configure Portal

In this phase, you will create an OAuth client in the Identity Admin Console, grant it the required permissions, create a test user, and link the Portal to the client.

Prerequisites

• Phase 1 completed — Identity and Portal containers are running.
• Access to the Identity Admin Console at https://<hostname>:<identity_port>/admin.

Step 1 — Log in to Identity Admin Console

Open the Identity Admin Console in your browser:

https://<hostname>:<identity_port>/admin

Log in with the default admin credentials:

• Username: admin
• Password: identity

Step 2 — Create a realm

NQRust-Identity groups clients, users, and roles into realms. Create a dedicated realm for Portal:

1. In the left sidebar, click the Manage realms menu (the shield icon at the top of the sidebar).
2. Click the Create realm button at the top of the realms list.
3. In the Realm name field, enter nqrust.
4. Click Create.

Step 3 — Create the Portal OAuth client

With the nqrust realm selected (check the realm name shown at the top of the left sidebar), create the OAuth client that the Portal will use. The wizard has three steps: General settings, Capability config, and Login settings.

To open the wizard:

1. In the left sidebar, click Clients.
2. Click the Create client button.

Step 3.1 — General settings

On the first wizard step, fill in the form as follows:

Click Next to continue.

Step 3.2 — Capability config

On the second wizard step, configure the following options:

• Client authentication — toggle to On.
• Authorization — toggle to On.
• Authentication flow — make sure these two checkboxes are checked:
  • ✅ Standard flow
  • ✅ Service accounts roles
• PKCE Method — leave as Choose... (no value).

Click Next to continue.

Step 3.3 — Login settings

On the Login settings step, configure the URLs based on your hostname and portal port:

Example with hostname 192.168.1.100 and portal port 8083:

Root URL:                    https://192.168.1.100:8083
Home URL:                    https://192.168.1.100:8083
Valid redirect URIs:         https://192.168.1.100:8083/api/auth/callback/keycloak
Valid post logout URIs:      https://192.168.1.100:8083
Web origins:                 https://192.168.1.100:8083

Click Save.

Step 4 — Assign service account roles to the client

The Portal client needs permission to manage realm resources (users, roles, clients) via the Identity REST API. You grant these permissions through the client's service account.

1. On the nqrust-portal client page, click the Service accounts roles tab.

2. Click Assign role. A dialog appears asking which type of role to assign — choose Client roles (not Realm roles), since realm-management is itself a client.
3. In the search field, type realm-management to filter the list.
4. Select every role from the realm-management client. The checkbox in the table header only selects roles on the current page — so after checking it, use the pagination controls at the bottom of the table to move to the next page and check the header again. Repeat until every page has all roles checked. To make this faster, you can increase the rows-per-page setting at the bottom of the table so all roles fit on a single page.
5. Click Assign.

Step 5 — Copy the client secret

With the client configured and its service account permissioned, click the Credentials tab of the nqrust-portal client:

1. Locate the Client secret field.
2. Click the copy button to copy the secret to your clipboard.
3. Keep this value handy — you will paste it into the installer in a later step.

Step 6 — Create a user

You need at least one user in the nqrust realm to log in to the Portal.

1. Make sure the nqrust realm is still selected.
2. In the left sidebar, click Users.
3. Click Add user.
4. Fill in the basic fields:
   • Username — e.g. testuser
   • Email — e.g. testuser@example.com
   • Email verified — toggle to On
   • First name — e.g. Test
   • Last name — e.g. User
5. Click Create.

Set the user password

After the user is created, the user detail page opens. Set an initial password:

1. Click the Credentials tab.
2. Click Set password.
3. Enter a password and its confirmation.
4. Set Temporary to Off if you don't want the user to be forced to change password on first login.
5. Click Save, then confirm on the dialog.

Step 7 — Fill the Portal form in the installer

Switch back to the installer terminal. If you exited after Phase 1, re-launch it and select Install Portal from the home menu. Otherwise, press i on the Identity success screen to continue.

The Portal form asks for three values:

Navigate to the Install button and press Enter to apply the configuration.

Step 8 — Portal restart

The installer updates the .env file with the new client configuration and restarts the Portal container:

docker compose up -d --force-recreate portal

Step 9 — Installation complete

Once the Portal container restarts successfully, the final success screen shows the Portal URL:

Portal: https://<hostname>:<portal_port>

Step 10 — Verify the installation

Open the Portal URL in your browser:

https://<hostname>:<portal_port>

You will be redirected to the Identity login page served by the nqrust realm. Log in with the user you created in Step 6.

After a successful login, you should see the Portal home screen.

Congratulations — your NQRust-Identity Portal is fully installed and ready to use!