[{"data":1,"prerenderedAt":1644},["ShallowReactive",2],{"docs-navigation":3,"doc-\u002Fteam\u002Fsso-keycloak":434},[4,22,104,157,194,211,224,265,302,335,364,380,397,414],{"title":5,"path":6,"stem":7,"children":8,"page":21},"Erste Schritte","\u002Fgetting-started","01.getting-started",[9,13,17],{"title":10,"path":11,"stem":12},"Was ist LIVCK Cloud?","\u002Fgetting-started\u002Fwhat-is-livck","01.getting-started\u002F01.what-is-livck",{"title":14,"path":15,"stem":16},"Schnellstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart",{"title":18,"path":19,"stem":20},"Das Dashboard","\u002Fgetting-started\u002Fdashboard","01.getting-started\u002F03.dashboard",false,{"title":23,"path":24,"stem":25,"children":26,"page":21},"Monitoring","\u002Fmonitoring","02.monitoring",[27,31,64,68,72,76,80,84,88,92,96,100],{"title":28,"path":29,"stem":30},"Services verwalten","\u002Fmonitoring\u002Fservices","02.monitoring\u002F01.services",{"title":32,"path":33,"stem":34,"children":35,"page":21},"Check-Typen","\u002Fmonitoring\u002Fchecks","02.monitoring\u002F02.checks",[36,40,44,48,52,56,60],{"title":37,"path":38,"stem":39},"HTTP\u002FHTTPS-Checks","\u002Fmonitoring\u002Fchecks\u002Fhttp","02.monitoring\u002F02.checks\u002F01.http",{"title":41,"path":42,"stem":43},"TCP-Port-Checks","\u002Fmonitoring\u002Fchecks\u002Ftcp","02.monitoring\u002F02.checks\u002F02.tcp",{"title":45,"path":46,"stem":47},"DNS-Checks","\u002Fmonitoring\u002Fchecks\u002Fdns","02.monitoring\u002F02.checks\u002F03.dns",{"title":49,"path":50,"stem":51},"Ping-Checks (ICMP)","\u002Fmonitoring\u002Fchecks\u002Ficmp","02.monitoring\u002F02.checks\u002F04.icmp",{"title":53,"path":54,"stem":55},"SSL-Zertifikat-Checks","\u002Fmonitoring\u002Fchecks\u002Fssl","02.monitoring\u002F02.checks\u002F05.ssl",{"title":57,"path":58,"stem":59},"Heartbeat-Checks (Push-Monitoring)","\u002Fmonitoring\u002Fchecks\u002Fheartbeat","02.monitoring\u002F02.checks\u002F06.heartbeat",{"title":61,"path":62,"stem":63},"Manuelle Services","\u002Fmonitoring\u002Fchecks\u002Fmanual","02.monitoring\u002F02.checks\u002F07.manual",{"title":65,"path":66,"stem":67},"Check-Einstellungen","\u002Fmonitoring\u002Fcheck-settings","02.monitoring\u002F03.check-settings",{"title":69,"path":70,"stem":71},"Bedingungen","\u002Fmonitoring\u002Fconditions","02.monitoring\u002F04.conditions",{"title":73,"path":74,"stem":75},"Monitoring-Standorte","\u002Fmonitoring\u002Flocations","02.monitoring\u002F05.locations",{"title":77,"path":78,"stem":79},"Service-Detailseite","\u002Fmonitoring\u002Fservice-detail","02.monitoring\u002F06.service-detail",{"title":81,"path":82,"stem":83},"Artifacts","\u002Fmonitoring\u002Fartifacts","02.monitoring\u002F07.artifacts",{"title":85,"path":86,"stem":87},"Status überschreiben","\u002Fmonitoring\u002Fstatus-override","02.monitoring\u002F08.status-override",{"title":89,"path":90,"stem":91},"Eigene Zertifikate (mTLS & private CAs)","\u002Fmonitoring\u002Fcertificates","02.monitoring\u002F09.certificates",{"title":93,"path":94,"stem":95},"Tags","\u002Fmonitoring\u002Ftags","02.monitoring\u002F10.tags",{"title":97,"path":98,"stem":99},"Sync-Quellen","\u002Fmonitoring\u002Fsync-sources","02.monitoring\u002F11.sync-sources",{"title":101,"path":102,"stem":103},"CDN & WAF-Integration","\u002Fmonitoring\u002Fcdn-waf-integration","02.monitoring\u002F12.cdn-waf-integration",{"title":105,"path":106,"stem":107,"children":108,"page":21},"Server-Monitoring","\u002Fserver-monitoring","03.server-monitoring",[109,113,117,121,125,129,133,137,141,145,149,153],{"title":110,"path":111,"stem":112},"Überblick","\u002Fserver-monitoring\u002Foverview","03.server-monitoring\u002F01.overview",{"title":114,"path":115,"stem":116},"Agent installieren","\u002Fserver-monitoring\u002Finstallation","03.server-monitoring\u002F02.installation",{"title":118,"path":119,"stem":120},"Sicherheit & Transparenz","\u002Fserver-monitoring\u002Fsecurity","03.server-monitoring\u002F03.security",{"title":122,"path":123,"stem":124},"Was gemessen wird","\u002Fserver-monitoring\u002Fmetrics","03.server-monitoring\u002F04.metrics",{"title":126,"path":127,"stem":128},"Serverliste & Detailansicht","\u002Fserver-monitoring\u002Fservers","03.server-monitoring\u002F05.servers",{"title":130,"path":131,"stem":132},"Alarm-Regeln","\u002Fserver-monitoring\u002Falert-rules","03.server-monitoring\u002F06.alert-rules",{"title":134,"path":135,"stem":136},"Ereignisse & Benachrichtigungen","\u002Fserver-monitoring\u002Fevents","03.server-monitoring\u002F07.events",{"title":138,"path":139,"stem":140},"Erreichbarkeits-Prüfungen","\u002Fserver-monitoring\u002Freachability","03.server-monitoring\u002F08.reachability",{"title":142,"path":143,"stem":144},"Agent-Updates","\u002Fserver-monitoring\u002Fupdates","03.server-monitoring\u002F09.updates",{"title":146,"path":147,"stem":148},"Auf der Statuspage zeigen","\u002Fserver-monitoring\u002Fstatuspage","03.server-monitoring\u002F10.statuspage",{"title":150,"path":151,"stem":152},"Grenzen & Pläne","\u002Fserver-monitoring\u002Flimits","03.server-monitoring\u002F11.limits",{"title":154,"path":155,"stem":156},"Fehlerbehebung","\u002Fserver-monitoring\u002Ftroubleshooting","03.server-monitoring\u002F12.troubleshooting",{"title":158,"path":159,"stem":160,"children":161,"page":21},"Incidents","\u002Fincidents","04.incidents",[162,166,170,174,178,182,186,190],{"title":163,"path":164,"stem":165},"Incidents verstehen","\u002Fincidents\u002Foverview","04.incidents\u002F01.overview",{"title":167,"path":168,"stem":169},"Incident erstellen","\u002Fincidents\u002Fcreate-incident","04.incidents\u002F02.create-incident",{"title":171,"path":172,"stem":173},"Incident verwalten","\u002Fincidents\u002Fmanage-incident","04.incidents\u002F03.manage-incident",{"title":175,"path":176,"stem":177},"Automatische Erkennung","\u002Fincidents\u002Fauto-detection","04.incidents\u002F04.auto-detection",{"title":179,"path":180,"stem":181},"Interne Kommentare","\u002Fincidents\u002Fincident-comments","04.incidents\u002F05.incident-comments",{"title":183,"path":184,"stem":185},"Postmortems","\u002Fincidents\u002Fpostmortems","04.incidents\u002F06.postmortems",{"title":187,"path":188,"stem":189},"Incident-Richtlinien","\u002Fincidents\u002Fincident-policies","04.incidents\u002F07.incident-policies",{"title":191,"path":192,"stem":193},"Incident-Vorlagen","\u002Fincidents\u002Fincident-templates","04.incidents\u002F08.incident-templates",{"title":195,"path":196,"stem":197,"children":198,"page":21},"Eskalation","\u002Fescalation","05.escalation",[199,203,207],{"title":200,"path":201,"stem":202},"Eskalationsrichtlinien","\u002Fescalation\u002Fpolicies","05.escalation\u002F01.policies",{"title":204,"path":205,"stem":206},"Eskalation während eines Incidents","\u002Fescalation\u002Fduring-incident","05.escalation\u002F02.during-incident",{"title":208,"path":209,"stem":210},"Betriebszeiten (On-Call)","\u002Fescalation\u002Foperating-schedules","05.escalation\u002F03.operating-schedules",{"title":212,"path":213,"stem":214,"children":215,"page":21},"Wartungen","\u002Fmaintenance","06.maintenance",[216,220],{"title":217,"path":218,"stem":219},"Wartungen planen","\u002Fmaintenance\u002Foverview","06.maintenance\u002F01.overview",{"title":221,"path":222,"stem":223},"Wartungs-Benachrichtigungen","\u002Fmaintenance\u002Fnotifications","06.maintenance\u002F02.notifications",{"title":225,"path":226,"stem":227,"children":228,"page":21},"Statuspages","\u002Fstatuspages","07.statuspages",[229,233,237,241,245,249,253,257,261],{"title":230,"path":231,"stem":232},"Statuspages verstehen","\u002Fstatuspages\u002Foverview","07.statuspages\u002F01.overview",{"title":234,"path":235,"stem":236},"Statuspage erstellen","\u002Fstatuspages\u002Fcreate-statuspage","07.statuspages\u002F02.create-statuspage",{"title":238,"path":239,"stem":240},"Zugriffskontrolle","\u002Fstatuspages\u002Faccess-control","07.statuspages\u002F03.access-control",{"title":242,"path":243,"stem":244},"Komponenten verwalten","\u002Fstatuspages\u002Fcomponents","07.statuspages\u002F04.components",{"title":246,"path":247,"stem":248},"Abonnenten (Subscriber)","\u002Fstatuspages\u002Fsubscribers","07.statuspages\u002F05.subscribers",{"title":250,"path":251,"stem":252},"Custom Domains","\u002Fstatuspages\u002Fcustom-domains","07.statuspages\u002F06.custom-domains",{"title":254,"path":255,"stem":256},"Öffentliche Ansicht","\u002Fstatuspages\u002Fpublic-view","07.statuspages\u002F07.public-view",{"title":258,"path":259,"stem":260},"Layout-Builder","\u002Fstatuspages\u002Flayout-builder","07.statuspages\u002F08.layout-builder",{"title":262,"path":263,"stem":264},"Metriken","\u002Fstatuspages\u002Fmetrics","07.statuspages\u002F09.metrics",{"title":266,"path":267,"stem":268,"children":269,"page":21},"Team & Organisation","\u002Fteam","08.team",[270,274,278,282,286,290,294,298],{"title":271,"path":272,"stem":273},"Organisationen","\u002Fteam\u002Forganizations","08.team\u002F01.organizations",{"title":275,"path":276,"stem":277},"Mitglieder verwalten","\u002Fteam\u002Fmembers","08.team\u002F02.members",{"title":279,"path":280,"stem":281},"Rollen & Berechtigungen","\u002Fteam\u002Froles","08.team\u002F03.roles",{"title":283,"path":284,"stem":285},"Teams","\u002Fteam\u002Fteams","08.team\u002F04.teams",{"title":287,"path":288,"stem":289},"Einladungen","\u002Fteam\u002Finvitations","08.team\u002F05.invitations",{"title":291,"path":292,"stem":293},"Enterprise SSO (Single Sign-On)","\u002Fteam\u002Fsso","08.team\u002F06.sso",{"title":295,"path":296,"stem":297},"Entra ID (Azure AD) einrichten","\u002Fteam\u002Fsso-entra","08.team\u002F07.sso-entra",{"title":299,"path":300,"stem":301},"Keycloak einrichten","\u002Fteam\u002Fsso-keycloak","08.team\u002F08.sso-keycloak",{"title":303,"path":304,"stem":305,"children":306,"page":21},"Abrechnung","\u002Fbilling","09.billing",[307,311,315,319,323,327,331],{"title":308,"path":309,"stem":310},"Pläne & Preise","\u002Fbilling\u002Fplans","09.billing\u002F01.plans",{"title":312,"path":313,"stem":314},"Plan wechseln","\u002Fbilling\u002Fupgrade-downgrade","09.billing\u002F02.upgrade-downgrade",{"title":316,"path":317,"stem":318},"Zahlungsmethoden","\u002Fbilling\u002Fpayment","09.billing\u002F03.payment",{"title":320,"path":321,"stem":322},"Rechnungen","\u002Fbilling\u002Finvoices","09.billing\u002F04.invoices",{"title":324,"path":325,"stem":326},"SMS- & Voice-Guthaben","\u002Fbilling\u002Fsms-credits","09.billing\u002F05.sms-credits",{"title":328,"path":329,"stem":330},"Plan-Limits","\u002Fbilling\u002Flimits","09.billing\u002F06.limits",{"title":332,"path":333,"stem":334},"Add-Ons","\u002Fbilling\u002Fadd-ons","09.billing\u002F07.add-ons",{"title":336,"path":337,"stem":338,"children":339,"page":21},"Account & Sicherheit","\u002Faccount","10.account",[340,344,348,352,356,360],{"title":341,"path":342,"stem":343},"Profil bearbeiten","\u002Faccount\u002Fprofile","10.account\u002F01.profile",{"title":345,"path":346,"stem":347},"Passwort ändern","\u002Faccount\u002Fpassword","10.account\u002F02.password",{"title":349,"path":350,"stem":351},"Anmelden mit Google, GitHub & Discord","\u002Faccount\u002Fsocial-login","10.account\u002F03.social-login",{"title":353,"path":354,"stem":355},"Zwei-Faktor-Authentifizierung","\u002Faccount\u002Ftwo-factor","10.account\u002F04.two-factor",{"title":357,"path":358,"stem":359},"Account löschen","\u002Faccount\u002Fdelete-account","10.account\u002F05.delete-account",{"title":361,"path":362,"stem":363},"Erscheinungsbild","\u002Faccount\u002Fappearance","10.account\u002F06.appearance",{"title":365,"path":366,"stem":367,"children":368,"page":21},"Benachrichtigungen","\u002Fnotifications","11.notifications",[369,372,376],{"title":365,"path":370,"stem":371},"\u002Fnotifications\u002Foverview","11.notifications\u002F01.overview",{"title":373,"path":374,"stem":375},"Benachrichtigungskanäle","\u002Fnotifications\u002Fchannels","11.notifications\u002F02.channels",{"title":377,"path":378,"stem":379},"Persönliche Benachrichtigungs-Einstellungen","\u002Fnotifications\u002Fpreferences","11.notifications\u002F03.preferences",{"title":381,"path":382,"stem":383,"children":384,"page":21},"API","\u002Fapi","12.api",[385,389,393],{"title":386,"path":387,"stem":388},"API-Übersicht","\u002Fapi\u002Foverview","12.api\u002F01.overview",{"title":390,"path":391,"stem":392},"API-Tokens","\u002Fapi\u002Ftokens","12.api\u002F02.tokens",{"title":394,"path":395,"stem":396},"API-Endpunkte","\u002Fapi\u002Fendpoints","12.api\u002F03.endpoints",{"title":398,"path":399,"stem":400,"children":401,"page":21},"SLA","\u002Fsla","13.sla",[402,406,410],{"title":403,"path":404,"stem":405},"SLA-Monitoring","\u002Fsla\u002Foverview","13.sla\u002F01.overview",{"title":407,"path":408,"stem":409},"SLA-Ziele","\u002Fsla\u002Fobjectives","13.sla\u002F02.objectives",{"title":411,"path":412,"stem":413},"SLA-Reports","\u002Fsla\u002Freports","13.sla\u002F03.reports",{"title":415,"path":416,"stem":417,"children":418,"page":21},"FAQ","\u002Ffaq","14.faq",[419,423,427,431],{"title":420,"path":421,"stem":422},"Allgemeine Fragen","\u002Ffaq\u002Fgeneral","14.faq\u002F01.general",{"title":424,"path":425,"stem":426},"Häufige Fragen zum Monitoring","\u002Ffaq\u002Fmonitoring-faq","14.faq\u002F02.monitoring-faq",{"title":428,"path":429,"stem":430},"Häufige Fragen zur Abrechnung","\u002Ffaq\u002Fbilling-faq","14.faq\u002F03.billing-faq",{"title":154,"path":432,"stem":433},"\u002Ffaq\u002Ftroubleshooting","14.faq\u002F04.troubleshooting",{"id":435,"title":299,"body":436,"description":1638,"extension":1639,"meta":1640,"navigation":1641,"path":300,"seo":1642,"stem":301,"__hash__":1643},"docs\u002F08.team\u002F08.sso-keycloak.md",{"type":437,"value":438,"toc":1602},"minimark",[439,443,454,474,479,486,556,565,568,572,577,584,605,616,620,689,693,702,705,709,714,717,778,793,797,802,805,815,819,826,852,927,934,940,944,974,981,985,991,1057,1062,1066,1073,1077,1082,1085,1105,1110,1114,1121,1142,1144,1148,1151,1155,1158,1162,1167,1204,1208,1213,1217,1223,1237,1276,1283,1308,1312,1347,1351,1365,1369,1378,1381,1383,1387,1391,1450,1454,1463,1467,1470,1484,1488,1494,1497,1507,1510,1516,1532,1536,1555,1559,1573,1575,1579],[440,441,299],"h1",{"id":442},"keycloak-einrichten",[444,445,446,453],"p",{},[447,448,452],"a",{"href":449,"rel":450},"https:\u002F\u002Fwww.keycloak.org\u002F",[451],"nofollow","Keycloak"," ist als OIDC-Identity-Provider vollständig unterstützt. Diese Anleitung führt dich durch die Einrichtung — vom Anlegen des Realm-Clients bis zum Gruppen-Mapping in LIVCK.",[455,456,459],"callout",{"title":457,"type":458},"Voraussetzung","info",[444,460,461,464,465,469,470,473],{},[447,462,463],{"href":292},"Enterprise SSO"," ist für deine Organisation freigeschaltet und du hast die Berechtigung ",[466,467,468],"strong",{},"SSO verwalten",". Lege zuerst eine SSO-Verbindung in LIVCK an (Einstellungen → Organisation → SSO → Neue Verbindung) und kopiere die dort angezeigte ",[466,471,472],{},"Redirect-URI"," — du brauchst sie im nächsten Schritt.",[475,476,478],"h2",{"id":477},"übersicht","Übersicht",[444,480,481,482,485],{},"Keycloak kann Gruppenzugehörigkeiten auf ",[466,483,484],{},"zwei Wegen"," im Token liefern:",[487,488,489,508],"table",{},[490,491,492],"thead",{},[493,494,495,499,502,505],"tr",{},[496,497,498],"th",{},"Weg",[496,500,501],{},"Claim-Name",[496,503,504],{},"Inhalt",[496,506,507],{},"Empfohlen?",[509,510,511,532],"tbody",{},[493,512,513,519,526,529],{},[514,515,516],"td",{},[466,517,518],{},"Realm-Rollen",[514,520,521,525],{},[522,523,524],"code",{},"realm_access.roles"," (verschachtelt)",[514,527,528],{},"Array von Rollen-Namen",[514,530,531],{},"Nur mit eigenem Mapper",[493,533,534,539,544,551],{},[514,535,536],{},[466,537,538],{},"Gruppen",[514,540,541],{},[522,542,543],{},"groups",[514,545,546,547,550],{},"Array von Gruppen-Pfaden (z.B. ",[522,548,549],{},"\u002Flivck-admin",")",[514,552,553],{},[466,554,555],{},"Ja — für die meisten Fälle",[444,557,558,559,561,562,564],{},"Wir empfehlen ",[466,560,538],{},", weil sie im Standard-Keycloak-Mapper direkt als flaches Array im Token landen und sich sauber mappen lassen. Realm-Rollen liegen verschachtelt in ",[522,563,524],{}," und brauchen einen eigenen Protocol Mapper, damit LIVCK sie als Groups-Claim auslesen kann.",[566,567],"hr",{},[475,569,571],{"id":570},"weg-a-gruppen-empfohlen","Weg A: Gruppen (empfohlen)",[573,574,576],"h3",{"id":575},"_1-realm-falls-nötig-anlegen","1. Realm (falls nötig) anlegen",[444,578,579,580,583],{},"Keycloak organisiert alles in ",[466,581,582],{},"Realms",". Pro Organisation empfiehlt sich ein eigener Realm.",[585,586,587,593,599],"ol",{},[588,589,590],"li",{},[466,591,592],{},"Keycloak Admin Console → Menü oben links → Create Realm",[588,594,595,596],{},"Realm name: z.B. ",[522,597,598],{},"livck",[588,600,601,602],{},"→ ",[466,603,604],{},"Create",[455,606,609],{"title":607,"type":608},"Nicht im master-Realm","warning",[444,610,611,612,615],{},"Lege für produktive Anwendungen immer einen eigenen Realm an. Der ",[522,613,614],{},"master","-Realm ist für die Keycloak-Administration reserviert.",[573,617,619],{"id":618},"_2-client-registrieren","2. Client registrieren",[585,621,622,627,633,638,643,668,672,678,684],{},[588,623,624],{},[466,625,626],{},"Realm livck → Clients → Create client",[588,628,629,630],{},"Client type: ",[466,631,632],{},"OpenID Connect",[588,634,635,636],{},"Client ID: z.B. ",[522,637,598],{},[588,639,601,640],{},[466,641,642],{},"Next",[588,644,645,648,649],{},[466,646,647],{},"Authentication flow",":\n",[650,651,652,659,662,665],"ul",{},[588,653,654,655,658],{},"Client authentication: ☑ ",[466,656,657],{},"ON"," (damit wird ein Client-Secret erzeugt — zwingend für LIVCK)",[588,660,661],{},"Authorization: ☐ OFF",[588,663,664],{},"Standard flow: ☑ ON",[588,666,667],{},"Direct access grants: ☐ OFF (nicht empfohlen)",[588,669,601,670],{},[466,671,642],{},[588,673,674,677],{},[466,675,676],{},"Valid redirect URIs",": die Redirect-URI aus LIVCK eintragen",[588,679,680,683],{},[466,681,682],{},"Web origins",": leer (nicht benötigt)",[588,685,601,686],{},[466,687,688],{},"Save",[573,690,692],{"id":691},"_3-client-secret-kopieren","3. Client-Secret kopieren",[444,694,695,698,699],{},[466,696,697],{},"Clients → livck → Credentials → Client secret"," → ",[466,700,701],{},"Copy",[444,703,704],{},"Das Secret ist nur hier sichtbar — sicher ablegen.",[573,706,708],{"id":707},"_4-gruppen-anlegen","4. Gruppen anlegen",[444,710,711],{},[466,712,713],{},"Realm livck → Groups → Create group",[444,715,716],{},"Lege pro LIVCK-Rolle eine Gruppe an:",[487,718,719,732],{},[490,720,721],{},[493,722,723,726,729],{},[496,724,725],{},"Gruppenname",[496,727,728],{},"Pfad",[496,730,731],{},"LIVCK-Rolle",[509,733,734,748,763],{},[493,735,736,741,745],{},[514,737,738],{},[522,739,740],{},"livck-admin",[514,742,743],{},[522,744,549],{},[514,746,747],{},"Admin",[493,749,750,755,760],{},[514,751,752],{},[522,753,754],{},"livck-member",[514,756,757],{},[522,758,759],{},"\u002Flivck-member",[514,761,762],{},"Member",[493,764,765,770,775],{},[514,766,767],{},[522,768,769],{},"livck-viewer",[514,771,772],{},[522,773,774],{},"\u002Flivck-viewer",[514,776,777],{},"Viewer",[455,779,781],{"title":780,"type":458},"Gruppen-Pfad wird normalisiert",[444,782,783,784,786,787,786,789,792],{},"LIVCK entfernt den führenden Schrägstrich automatisch und vergleicht case-insensitiv. Sowohl ",[522,785,549],{}," als auch ",[522,788,740],{},[522,790,791],{},"LIVCK-Admin"," matchen die gleiche Gruppe. Trage im Mapping einfach den Wert ein, der dir im Keycloak-Admin angezeigt wird.",[573,794,796],{"id":795},"_5-benutzer-den-gruppen-zuweisen","5. Benutzer den Gruppen zuweisen",[444,798,799],{},[466,800,801],{},"Users → Benutzer auswählen → Groups tab → Join group → Gruppe wählen → Join",[444,803,804],{},"Wiederholen für jeden Benutzer \u002F jede Rolle.",[455,806,809],{"title":807,"type":808},"Häufigster Fehler","danger",[444,810,811,812,814],{},"Ohne diese Zuweisung liefert Keycloak einen leeren ",[522,813,543],{},"-Claim. Das ist der Schritt, der am häufigsten vergessen wird — und der Grund, warum \"keine Gruppen\" im Test-Login auftaucht.",[573,816,818],{"id":817},"_6-groups-claim-im-token-aktivieren","6. Groups-Claim im Token aktivieren",[444,820,821,822,825],{},"Keycloak liefert die Gruppen ",[466,823,824],{},"nicht automatisch"," im ID-Token. Du brauchst einen Protocol Mapper:",[585,827,828,833,843,849],{},[588,829,830],{},[466,831,832],{},"Clients → livck → Client scopes tab",[588,834,835,836,839,840],{},"Scope ",[522,837,838],{},"openid"," (oder den dedizierten Client-Scope) → ",[466,841,842],{},"Mappers tab → Add mapper → By configuration",[588,844,845,846],{},"Vorlage: ",[466,847,848],{},"Group Membership",[588,850,851],{},"Konfiguration:",[487,853,854,864],{},[490,855,856],{},[493,857,858,861],{},[496,859,860],{},"Feld",[496,862,863],{},"Wert",[509,865,866,876,885,901,911,919],{},[493,867,868,871],{},[514,869,870],{},"Name",[514,872,873,874],{},"z.B. ",[522,875,543],{},[493,877,878,881],{},[514,879,880],{},"Token Claim name",[514,882,883],{},[522,884,543],{},[493,886,887,890],{},[514,888,889],{},"Full group path",[514,891,892,893,895,896,898,899,550],{},"☑ ",[466,894,657],{}," (liefert ",[522,897,549],{}," statt nur ",[522,900,740],{},[493,902,903,906],{},[514,904,905],{},"Add to ID token",[514,907,892,908,910],{},[466,909,657],{}," ← Pflicht",[493,912,913,916],{},[514,914,915],{},"Add to access token",[514,917,918],{},"☐ OFF (nicht nötig)",[493,920,921,924],{},[514,922,923],{},"Add to userinfo",[514,925,926],{},"☑ ON (optional)",[585,928,930],{"start":929},5,[588,931,601,932],{},[466,933,688],{},[455,935,937],{"title":936,"type":608},"Im ID-Token ausliefern",[444,938,939],{},"Stelle sicher, dass \"Add to ID token\" aktiviert ist. LIVCK liest den Groups-Claim standardmäßig aus dem ID-Token.",[573,941,943],{"id":942},"_7-zugangsdaten-sammeln","7. Zugangsdaten sammeln",[650,945,946,960,968],{},[588,947,948,951,952,955,956,959],{},[466,949,950],{},"Issuer-URL",": ",[522,953,954],{},"https:\u002F\u002Fkeycloak.example.com\u002Frealms\u002Flivck"," (ohne ",[522,957,958],{},"\u002F.well-known\u002Fopenid-configuration"," am Ende — LIVCK hängt das Discovery-Suffix automatisch an)",[588,961,962,965,966,550],{},[466,963,964],{},"Client-ID",": aus Schritt 2 (",[522,967,598],{},[588,969,970,973],{},[466,971,972],{},"Client-Secret",": aus Schritt 3",[444,975,976,977,980],{},"Die Issuer-URL findest du auch unter ",[466,978,979],{},"Realm Settings → General → Issuer",".",[573,982,984],{"id":983},"_8-in-livck-eintragen","8. In LIVCK eintragen",[444,986,987,990],{},[466,988,989],{},"Einstellungen → Organisation → SSO → Verbindung bearbeiten → Konfiguration",":",[487,992,993,1001],{},[490,994,995],{},[493,996,997,999],{},[496,998,860],{},[496,1000,863],{},[509,1002,1003,1011,1018,1024,1037,1049],{},[493,1004,1005,1007],{},[514,1006,950],{},[514,1008,1009],{},[522,1010,954],{},[493,1012,1013,1015],{},[514,1014,964],{},[514,1016,1017],{},"aus Schritt 7",[493,1019,1020,1022],{},[514,1021,972],{},[514,1023,1017],{},[493,1025,1026,1031],{},[514,1027,1028],{},[466,1029,1030],{},"Groups-claim",[514,1032,1033],{},[466,1034,1035],{},[522,1036,543],{},[493,1038,1039,1044],{},[514,1040,1041],{},[466,1042,1043],{},"Quelle des Groups-claims",[514,1045,1046],{},[466,1047,1048],{},"ID-Token",[493,1050,1051,1054],{},[514,1052,1053],{},"Wenn keine Gruppe passt",[514,1055,1056],{},"nach Bedarf (Standard-Rolle \u002F Keine Rollen \u002F Login ablehnen)",[444,1058,601,1059],{},[466,1060,1061],{},"Konfiguration speichern",[573,1063,1065],{"id":1064},"_9-domain-verifizieren","9. Domain verifizieren",[444,1067,1068,1069,980],{},"Siehe ",[447,1070,1072],{"href":1071},"\u002Fteam\u002Fsso#2-domain-verifizieren","SSO einrichten → Domain verifizieren",[573,1074,1076],{"id":1075},"_10-mapping-anlegen","10. Mapping anlegen",[444,1078,1079,990],{},[466,1080,1081],{},"Einstellungen → Organisation → SSO → Verbindung → Mappings",[444,1083,1084],{},"Pro Gruppe einen Eintrag:",[650,1086,1087,1099],{},[588,1088,1089,1092,1093,1095,1096,1098],{},[466,1090,1091],{},"IdP-Gruppe",": der ",[466,1094,728],{}," aus Schritt 4 (z.B. ",[522,1097,549],{}," — führender Schrägstrich und Groß-\u002FKleinschreibung werden von LIVCK ignoriert)",[588,1100,1101,1104],{},[466,1102,1103],{},"Rolle",": die entsprechende LIVCK-Rolle",[444,1106,601,1107],{},[466,1108,1109],{},"Hinzufügen",[573,1111,1113],{"id":1112},"_11-testen","11. Testen",[444,1115,1116,1117,1120],{},"Klicke auf ",[466,1118,1119],{},"Login testen",". Im Dry-Run-Report sollte stehen:",[650,1122,1123,1130,1136],{},[588,1124,1125,951,1127],{},[466,1126,538],{},[522,1128,1129],{},"[\"livck-admin\"]",[588,1131,1132,1135],{},[466,1133,1134],{},"Ermittelte Rollen",": Admin",[588,1137,1138,1141],{},[466,1139,1140],{},"Würde sich anmelden",": ja",[566,1143],{},[475,1145,1147],{"id":1146},"weg-b-realm-rollen-alternativ","Weg B: Realm-Rollen (alternativ)",[444,1149,1150],{},"Verwende diesen Weg nur, wenn du bereits Keycloak-Rollen pflegst und keine Gruppen anlegen möchtest.",[573,1152,1154],{"id":1153},"_1-client-registrieren","1. Client registrieren",[444,1156,1157],{},"Wie Weg A, Schritte 1–3.",[573,1159,1161],{"id":1160},"_2-realm-rollen-anlegen","2. Realm-Rollen anlegen",[444,1163,1164],{},[466,1165,1166],{},"Realm Roles → Create role",[487,1168,1169,1178],{},[490,1170,1171],{},[493,1172,1173,1176],{},[496,1174,1175],{},"Rollenname",[496,1177,731],{},[509,1179,1180,1188,1196],{},[493,1181,1182,1186],{},[514,1183,1184],{},[522,1185,740],{},[514,1187,747],{},[493,1189,1190,1194],{},[514,1191,1192],{},[522,1193,754],{},[514,1195,762],{},[493,1197,1198,1202],{},[514,1199,1200],{},[522,1201,769],{},[514,1203,777],{},[573,1205,1207],{"id":1206},"_3-benutzer-die-rollen-zuweisen","3. Benutzer die Rollen zuweisen",[444,1209,1210],{},[466,1211,1212],{},"Users → Benutzer → Role mapping tab → Assign role → Rolle wählen",[573,1214,1216],{"id":1215},"_4-realm-rollen-als-flachen-claim-ausliefern","4. Realm-Rollen als flachen Claim ausliefern",[444,1218,1219,1220,1222],{},"Keycloak liefert Realm-Rollen verschachtelt in ",[522,1221,524],{},". Damit LIVCK sie als Groups-Claim auslesen kann, legst du einen Mapper an, der sie flach als eigenen Claim ausgibt:",[585,1224,1225,1230,1235],{},[588,1226,1227],{},[466,1228,1229],{},"Clients → livck → Client scopes tab → openid → Mappers tab → Add mapper → By configuration",[588,1231,845,1232],{},[466,1233,1234],{},"User Realm Role",[588,1236,851],{},[487,1238,1239,1247],{},[490,1240,1241],{},[493,1242,1243,1245],{},[496,1244,860],{},[496,1246,863],{},[509,1248,1249,1258,1268],{},[493,1250,1251,1253],{},[514,1252,870],{},[514,1254,873,1255],{},[522,1256,1257],{},"realm-roles",[493,1259,1260,1263],{},[514,1261,1262],{},"Token claim name",[514,1264,1265,1267],{},[522,1266,543],{}," ← LIVCK liest diesen Namen aus",[493,1269,1270,1272],{},[514,1271,905],{},[514,1273,892,1274],{},[466,1275,657],{},[585,1277,1279],{"start":1278},4,[588,1280,601,1281],{},[466,1282,688],{},[455,1284,1286],{"title":1285,"type":608},"Claim-Name = groups",[444,1287,1288,1289,1293,1294,1297,1298,1301,1302,1304,1305,1307],{},"Trage als Token-Claim-Name ",[466,1290,1291],{},[522,1292,543],{}," ein, nicht ",[522,1295,1296],{},"roles"," oder ",[522,1299,1300],{},"realm_access",". LIVCK erwartet den unter ",[466,1303,1030],{}," konfigurierten Namen. Wenn du den Mapper ",[522,1306,1257],{}," nennst, landet der Claim trotzdem unter dem konfigurierten Token-Claim-Namen.",[573,1309,1311],{"id":1310},"_5-in-livck-eintragen","5. In LIVCK eintragen",[487,1313,1314,1322],{},[490,1315,1316],{},[493,1317,1318,1320],{},[496,1319,860],{},[496,1321,863],{},[509,1323,1324,1337],{},[493,1325,1326,1330],{},[514,1327,1328],{},[466,1329,1030],{},[514,1331,1332,1336],{},[466,1333,1334],{},[522,1335,543],{}," (entspricht dem Token-Claim-Namen aus Schritt 4)",[493,1338,1339,1343],{},[514,1340,1341],{},[466,1342,1043],{},[514,1344,1345],{},[466,1346,1048],{},[573,1348,1350],{"id":1349},"_6-mapping-anlegen","6. Mapping anlegen",[650,1352,1353,1360],{},[588,1354,1355,1357,1358,550],{},[466,1356,1091],{},": exakt der Rollenname (z.B. ",[522,1359,740],{},[588,1361,1362,1364],{},[466,1363,1103],{},": die LIVCK-Rolle",[573,1366,1368],{"id":1367},"_7-nachteil-verschachtelte-default-rollen","7. Nachteil: verschachtelte Default-Rollen",[444,1370,1371,1372,1374,1375,1377],{},"Ohne den eigenen Mapper (Weg B Schritt 4) bleiben die Rollen in ",[522,1373,524],{}," verschachtelt. LIVCK kann diese Struktur nicht auslesen — der ",[522,1376,543],{},"-Claim bleibt leer und der Login schlägt fehl.",[444,1379,1380],{},"Lösung: Verwende Weg A (Gruppen) oder den Mapper aus Schritt 4.",[566,1382],{},[475,1384,1386],{"id":1385},"troubleshooting","Troubleshooting",[573,1388,1390],{"id":1389},"im-test-login-steht-kein-groups-claim-empfangen","Im Test-Login steht \"kein groups-Claim empfangen\"",[487,1392,1393,1403],{},[490,1394,1395],{},[493,1396,1397,1400],{},[496,1398,1399],{},"Ursache",[496,1401,1402],{},"Lösung",[509,1404,1405,1413,1421,1429,1442],{},[493,1406,1407,1410],{},[514,1408,1409],{},"Benutzer ist keiner Gruppe zugewiesen",[514,1411,1412],{},"Users → Benutzer → Groups → Gruppe zuweisen",[493,1414,1415,1418],{},[514,1416,1417],{},"Group-Mapper fehlt oder ist falsch konfiguriert",[514,1419,1420],{},"Clients → livck → Mappers → Group Membership prüfen",[493,1422,1423,1426],{},[514,1424,1425],{},"\"Add to ID token\" ist deaktiviert",[514,1427,1428],{},"Mapper → Checkbox setzen → Save",[493,1430,1431,1436],{},[514,1432,1433,1434],{},"Groups-Claim-Feld steht auf ",[522,1435,524],{},[514,1437,1438,1439,1441],{},"auf ",[522,1440,543],{}," umstellen (oder Mapper aus Weg B anlegen)",[493,1443,1444,1447],{},[514,1445,1446],{},"Quelle steht auf UserInfo-Endpoint",[514,1448,1449],{},"auf ID-Token umstellen",[573,1451,1453],{"id":1452},"im-test-login-stehen-pfade-statt-reinen-namen","Im Test-Login stehen Pfade statt reinen Namen",[444,1455,1456,1457,1459,1460,1462],{},"Du hast \"Full group path\" im Mapper aktiviert. Das ist in Ordnung — LIVCK entfernt den führenden Schrägstrich automatisch, daher matchen ",[522,1458,549],{}," und ",[522,1461,740],{}," gleichermaßen.",[573,1464,1466],{"id":1465},"im-test-login-steht-die-richtige-gruppe-aber-login-schlägt-fehl","Im Test-Login steht die richtige Gruppe, aber Login schlägt fehl",[444,1468,1469],{},"Prüfe:",[650,1471,1472,1475,1478,1481],{},[588,1473,1474],{},"Ist die E-Mail-Domain verifiziert? (SSO → Domains)",[588,1476,1477],{},"Ist die Verbindung aktiviert?",[588,1479,1480],{},"Hat der Benutzer eine verifizierte E-Mail im Keycloak?",[588,1482,1483],{},"Stimmt die Redirect-URI exakt? (inkl. HTTPS-Schema, kein Trailing-Slash)",[573,1485,1487],{"id":1486},"issuer-url-validieren","Issuer-URL validieren",[444,1489,1490,1491,1493],{},"Die Issuer-URL muss exakt sein — ohne Trailing-Slash und ohne ",[522,1492,958],{}," am Ende. LIVCK hängt das Discovery-Suffix automatisch an.",[444,1495,1496],{},"Richtig:",[1498,1499,1504],"pre",{"className":1500,"code":1502,"language":1503},[1501],"language-text","https:\u002F\u002Fkeycloak.example.com\u002Frealms\u002Flivck\n","text",[522,1505,1502],{"__ignoreMap":1506},"",[444,1508,1509],{},"Falsch:",[1498,1511,1514],{"className":1512,"code":1513,"language":1503},[1501],"https:\u002F\u002Fkeycloak.example.com\u002Frealms\u002Flivck\u002F.well-known\u002Fopenid-configuration\nhttps:\u002F\u002Fkeycloak.example.com\u002Frealms\u002Flivck\u002F\nhttps:\u002F\u002Fkeycloak.example.com\u002Fauth\u002Frealms\u002Flivck   ← alter Pfad (nur Keycloak \u003C 17)\n",[522,1515,1513],{"__ignoreMap":1506},[455,1517,1519],{"title":1518,"type":608},"Keycloak 17+ Pfad",[444,1520,1521,1522,1525,1526,1529,1530,980],{},"Ab Keycloak 17 (Quarkus) entfällt das ",[522,1523,1524],{},"\u002Fauth\u002F","-Segment im Pfad. Bei älteren WildFly-Distributionen heißt die Issuer-URL ",[522,1527,1528],{},"https:\u002F\u002Fkeycloak.example.com\u002Fauth\u002Frealms\u002F{realm}",". Prüfe die URL unter ",[466,1531,979],{},[573,1533,1535],{"id":1534},"invalid-issuer-oder-discovery-schlägt-fehl","\"Invalid issuer\" oder Discovery schlägt fehl",[650,1537,1538,1541,1544],{},[588,1539,1540],{},"Prüfe, dass die Realm-URL von außerhalb deines Netzwerks erreichbar ist.",[588,1542,1543],{},"Keycloak muss mit gügltigem TLS-Zertifikat laufen — LIVCK validiert die Discovery-Dokumente.",[588,1545,1546,1547,1550,1551,1554],{},"Falls du hinter einem Reverse-Proxy betreibst: stelle sicher, dass Keycloak den ",[522,1548,1549],{},"proxy-headers"," Modus kennt (",[522,1552,1553],{},"KC_PROXY_HEADERS=true"," bei Quarkus).",[573,1556,1558],{"id":1557},"client-authentication-fehler-401","Client-Authentication-Fehler (401)",[650,1560,1561,1564,1570],{},[588,1562,1563],{},"Client-Secret korrekt kopiert? (nicht der Client-ID)",[588,1565,1566,1567,1569],{},"Client authentication ist im Client auf ",[466,1568,657],{},"?",[588,1571,1572],{},"Redirect-URI stimmt exakt überein?",[566,1574],{},[475,1576,1578],{"id":1577},"weiterführende-themen","Weiterführende Themen",[650,1580,1581,1586,1591,1597],{},[588,1582,1583],{},[447,1584,1585],{"href":292},"Enterprise SSO – Übersicht",[588,1587,1588,1590],{},[447,1589,279],{"href":280}," – Ziel der Gruppen-Zuordnung",[588,1592,1593,1596],{},[447,1594,1595],{"href":276},"Mitglieder"," – Wer gehört zur Organisation",[588,1598,1599,1601],{},[447,1600,295],{"href":296}," – Alternative mit App-Rollen",{"title":1506,"searchDepth":1603,"depth":1603,"links":1604},3,[1605,1607,1620,1629,1637],{"id":477,"depth":1606,"text":478},2,{"id":570,"depth":1606,"text":571,"children":1608},[1609,1610,1611,1612,1613,1614,1615,1616,1617,1618,1619],{"id":575,"depth":1603,"text":576},{"id":618,"depth":1603,"text":619},{"id":691,"depth":1603,"text":692},{"id":707,"depth":1603,"text":708},{"id":795,"depth":1603,"text":796},{"id":817,"depth":1603,"text":818},{"id":942,"depth":1603,"text":943},{"id":983,"depth":1603,"text":984},{"id":1064,"depth":1603,"text":1065},{"id":1075,"depth":1603,"text":1076},{"id":1112,"depth":1603,"text":1113},{"id":1146,"depth":1606,"text":1147,"children":1621},[1622,1623,1624,1625,1626,1627,1628],{"id":1153,"depth":1603,"text":1154},{"id":1160,"depth":1603,"text":1161},{"id":1206,"depth":1603,"text":1207},{"id":1215,"depth":1603,"text":1216},{"id":1310,"depth":1603,"text":1311},{"id":1349,"depth":1603,"text":1350},{"id":1367,"depth":1603,"text":1368},{"id":1385,"depth":1606,"text":1386,"children":1630},[1631,1632,1633,1634,1635,1636],{"id":1389,"depth":1603,"text":1390},{"id":1452,"depth":1603,"text":1453},{"id":1465,"depth":1603,"text":1466},{"id":1486,"depth":1603,"text":1487},{"id":1534,"depth":1603,"text":1535},{"id":1557,"depth":1603,"text":1558},{"id":1577,"depth":1606,"text":1578},"Schritt-für-Schritt-Anleitung für Keycloak als SSO-Identity-Provider – inklusive Realm-Client, Gruppen-Mapping und Troubleshooting.","md",{},null,{"title":299,"description":1638},"rpPAvB9ImOgZ2GB_RxLVCutIx4C1T_bUAOqKxoG_0kM",1784953294246]