DevOps Tools, CI/CD and Automation Guides

Find what makes a Git repository large, remove unwanted files with git-filter-repo or retain only recent commits, verify the smaller .git folder, and publish rewritten history safely.

Get passwordless Keycloak Windows SSO with Active Directory Kerberos SPNEGO after the SPN and keytab are set—vm1.lab.example URL, Edge AuthServerAllowlist, principal LDAP lookup, curl Negotiate proof, and silent browser …

Connect Keycloak 26.7.3 to OpenLDAP with LDAP user federation—bind DN, Users DN, uid and entryUUID mapping, full user sync, and OpenLDAP password login through Keycloak.

Configure Keycloak 26.7.3 Kerberos against Microsoft AD—HTTP SPN, keytab, krb5 realm mapping, and Allow Kerberos authentication on the existing lab-ad LDAP provider without a second Kerberos federation provider.

How Keycloak identity brokering works: upstream IdPs, broker endpoints, first broker login, OIDC and SAML paths, and how brokering differs from LDAP and Kerberos user federation.

Troubleshoot Keycloak 26.7.3 when Active Directory users sync but cannot sign in—wrong password vs bind account, userAccountControl, pwdLastSet, disabled accounts, and LDAP error 52e on RHEL.

Provision Microsoft Entra ID users into Keycloak with native SCIM: User Profile externalId, OAuth client credentials, Entra non-gallery provisioning, attribute matching, and verification.

Fix Keycloak SAML Invalid Destination errors by comparing the SAMLResponse Destination with the broker ACS URL, then correcting the IdP ACS, hostname, or reverse-proxy configuration.

Connect Keycloak 26.7.3 to Microsoft Active Directory over LDAPS on port 636—DC certificate trust, StartTLS vs LDAPS for AD, provider settings, ldapsearch checks, and Test connection.

Configure Keycloak SCIM authentication with confidential service-account clients, the SCIM audience claim, and least-privilege realm-management roles for read vs provision access.

Configure a service provider as a Keycloak SAML client—Client ID, ACS URL, redirect URI, NameID format, and signing options—then test one SP-initiated login on Keycloak 26.7.3.

Use a Keycloak realm as a SAML 2.0 identity provider—stable hostname, IdP metadata URL, signing keys, and what to give the service provider before you register a SAML client.

Troubleshoot Keycloak 26.7.3 when Active Directory user sync imports zero users—Users DN and search scope under CN=Users, custom LDAP filters, bind error 49 data 52e, and ldapsearch checks on RHEL.

Troubleshoot Keycloak 26.7.3 when Active Directory group sync imports zero groups or users miss LDAP memberships—LDAP Groups DN, Builtin vs OU, memberOf vs recursive retrieve strategy, and nested AD groups on RHEL.

Choose sAMAccountName or userPrincipalName as the Keycloak Active Directory username LDAP attribute—canonical username, realm login settings, provider change with automatic username mapper sync on Keycloak 26.x, and lab …

Map Microsoft Active Directory security groups to Keycloak realm roles with the LDAP group mapper, memberOf membership, nested group hierarchy, group sync, and access-token verification on Keycloak 26.7.3.

Integrate Keycloak 26.7.3 with Microsoft Active Directory—LDAP user federation, StartTLS, user sync, AD password login through Keycloak, and READ_ONLY vs WRITABLE edit modes.

Configure Keycloak SAML Single Logout, inspect LogoutRequest and LogoutResponse messages, verify sessions on both realms, and diagnose a successful response that never reaches the service provider.

See why an Envoy Gateway WebSocket drops after HTTP 101, how the default stream idle timeout works, and how to tell a proxy close from a backend close.

Sign Keycloak SAML responses and assertions, require signed AuthnRequests, encrypt assertions to the service provider certificate, and check the XML with the peer public key.

See why Envoy Gateway returns HTTP 504 upstream request timeout at about 15 seconds, and how HTTPRoute timeouts.request and backendRequest change that deadline.

See why Envoy Gateway returns HTTP 408 when an upload arrives too slowly, and why that clock is not a body-size limit or proxy-read-timeout.

See why ingress-nginx proxy-read-timeout is an inactivity gap, and why copying that number onto HTTPRoute timeouts.request is a different deadline.

Tell an Envoy Gateway 504 from a slow-upload 408 and from an ingress-nginx proxy-read-timeout, and open the page that matches the failure.

Replace ingress-nginx proxy-body-size with Envoy Gateway requestBuffer.limit, and see why that policy buffers the whole request before it returns HTTP 413.

Bootstrap a local CA with cert-manager, sign an Envoy Gateway certificate from that CA, and verify HTTPS with curl --cacert when the hostname has no public DNS.

Fix a Keycloak SAML invalid signature by comparing certificate fingerprints, checking whether the response or assertion was signed, and separating a stale key from an unsigned AuthnRequest.

Compare a Keycloak SAML login that starts at the service provider with one that starts at the IdP-initiated client URL, including RelayState, InResponseTo, and the broker path that accepts an unsolicited response.

Keycloak rejects a SAML assertion when AudienceRestriction does not contain the service provider entity ID. Match the SAML client ID to that entity ID, and add an audience mapper only for an extra audience.

Decode a Keycloak SAMLResponse or SAMLRequest on Linux. HTTP-POST is Base64 XML. HTTP-Redirect is DEFLATE, then Base64, then URL encoding. Read Issuer, Destination, NameID, and Audience locally.