DevOps Tools, CI/CD and Automation Guides - Page 2

Move an existing oauth2-proxy login from ingress-nginx to Envoy Gateway, replace auth-url with a SecurityPolicy, and avoid the 202 response that does not admit the request.

Split requests between two app versions with HTTPRoute backend weights, map that ratio to ingress-nginx canary-weight, and roll the canary back to zero.

Keycloak shows Invalid redirect uri when a SAML AssertionConsumerServiceURL is not a Valid Redirect URI. Register the exact ACS, and use the POST binding or Master SAML Processing URL only when the request omits one.

See how cert-manager fills an Envoy Gateway TLS Secret with Let's Encrypt, why HTTP-01 needs port 80, and how to read the renewal time before the certificate expires.

Choose a Keycloak SAML NameID format and value, including email and a user attribute, and check the NameID element against what the service provider requested.

See how ingress2gateway handles rewrite-target and regex paths, why a capture group can arrive as the literal path /$2, when to use ReplacePrefixMatch, and how to preserve capture groups with an Envoy HTTPRouteFilter.

Map a Keycloak realm role, a client role, and a group into an outgoing SAML assertion, then limit which names the service provider receives.

Keep ingress-nginx serving while you convert one hostname to a Gateway and HTTPRoutes, compare Envoy on its own address, and change DNS only after the paths match.

Add a Keycloak user attribute and email to an outgoing SAML assertion with a protocol mapper, then read the Attribute element in the response.

Download a Keycloak SAML IdP descriptor, read the entity ID, SSO URL, and signing certificate, then import it into a second realm and check the broker SP metadata.

Configure SAML SSO with one Keycloak realm as the IdP and a second realm as the SP/broker, then finish one SP-initiated login on Keycloak 26.8.0.

Provision Keycloak users and groups with the SCIM 2.0 API: create, search, update, deactivate, and delete accounts, including PATCH, filters, and an enterprise user attribute.

Diagnose Keycloak SCIM 401 and 403 errors with curl: missing bearer tokens, invalid token audience, realm-management permissions, and protected admin resources.

Enable the Keycloak SCIM 2.0 API, configure a realm and service-account client, fix the token audience, and test SCIM endpoints with curl.

Configure multiple AWS CLI named profiles for dev and prod accounts, switch with --profile or AWS_PROFILE, verify the active account with aws sts get-caller-identity, and avoid profile and credential precedence mistakes …

Fix AWS CLI Unable to locate credentials by reading aws configure list, checking AWS_PROFILE and AWS environment variables, shared credential files, aws login, IAM Identity Center, and EC2 instance profile credentials on …

Configure Keycloak step-up authentication with LoA 1 password and LoA 2 OTP, map silver and gold ACR values, request acr_values from an OIDC client, step up from an existing SSO session, decode the acr claim, and handle …

Learn how to enable Keycloak recovery codes, generate and store backup codes, use Try another way for 2FA recovery, and regenerate spent codes.

Learn how Keycloak Conditional subflows evaluate built-in conditions, compare Conditional OTP Form with role-gated MFA subflows, combine Condition user role and user configured, test a four-state matrix, and debug …

What Keycloak Required Actions are, how to assign them, when they run at login or by email, and how to troubleshoot pending UPDATE_PASSWORD, VERIFY_EMAIL, and CONFIGURE_TOTP on Keycloak 26.7.3.

Learn how Keycloak passwordless authentication works with passkeys, WebAuthn, identity providers, and magic links, including enrollment, migration, and account recovery.

Enable Keycloak TOTP 2FA with realm OTP policy, Configure OTP required actions, authenticator app enrollment, browser login with OTP, selective enforcement patterns, lost-device credential reset, recovery-code handoff, …

Configure Keycloak realm SMTP in the Admin Console, choose SSL or STARTTLS, test email delivery, authenticate with password or XOAUTH2, and fix common connection errors on Keycloak 26.7.3.

Enable Keycloak 26.7.3 passkeys and WebAuthn passwordless login, register platform passkeys and security keys, configure RP ID and conditional UI, compare second-factor WebAuthn, and troubleshoot origin and missing …

Enable Keycloak forgot password with realm SMTP, test reset-credentials email links, compare safe responses for unknown usernames, fix missing buttons and mail failures, and handle expired action tokens on Keycloak …

Configure Keycloak realm password policy for length, history, expiry, blacklist, and regex rules, separate user-facing checks from Argon2 or PBKDF2 hashing parameters, test when policies apply to existing users, and …

Copy the Keycloak browser flow, add a Group MFA conditional subflow that requires OTP for users with realm role mfa-lab-required, bind browserFlow safely, test four login scenarios, and export realm configuration on …

Learn how Keycloak composes browser login from flows, subflows, and executions; how Required, Alternative, Conditional, and Disabled requirements evaluate; default Browser flow walkthrough, bindings, safe duplication, …

What Keycloak Implicit Flow is, why response_type=token is discouraged for new SPAs, how it differs from Authorization Code with PKCE, and how to migrate and disable implicit flow on Keycloak 26.7.3.

Bind Keycloak access tokens to a client-held EC key with DPoP proof JWTs, request sender-constrained tokens on Keycloak 26.7.3, verify proofs at a resource API, and reproduce replay and key-mismatch failures.