{"id":9128,"date":"2026-08-26T16:40:46","date_gmt":"2026-08-26T07:40:46","guid":{"rendered":"https:\/\/hasu0707.duckdns.org\/blog\/?p=9128"},"modified":"2026-09-05T23:07:07","modified_gmt":"2026-09-05T14:07:07","slug":"keycloak-%ec%84%9c%eb%b2%84-%ea%b5%ac%ec%b6%95-saml-2-0","status":"publish","type":"post","link":"https:\/\/hasu0707.duckdns.org\/blog\/?p=9128","title":{"rendered":"Keycloak \uc11c\ubc84 \uad6c\ucd95 (SAML 2.0)"},"content":{"rendered":"\n

Keycloak \uc124\uce58<\/h1>\n

\uc124\uce58 \uc900\ube44<\/h2>\n

\uc900\ube44<\/h3>\n

[RockyLinux]<\/strong><\/p>\n

dnf update -y\ndnf install -y curl wget tar gzip unzip vim bind-utils openssl jq policycoreutils-python-utils gnupg2\n#dnf install -y java-21-openjdk java-21-openjdk-devel\n<\/code><\/pre>\n
    \n
  • jdk 21\uc740 \/opt\/jdk\uc5d0 \uc218\ub3d9\uc73c\ub85c \uc124\uce58\ud55c\ub2e4.<\/li>\n<\/ul>\n
    [Debian\/Ubuntu]<\/strong><\/p>\n
    apt update\napt install -y curl wget tar gzip unzip vim dnsutils openssl jq policycoreutils-python-utils gnupg\n#apt install -y openjdk-21-jdk\n<\/code><\/pre>\n
      \n
    • jdk 21\uc740 \/opt\/jdk\uc5d0 \uc218\ub3d9\uc73c\ub85c \uc124\uce58\ud55c\ub2e4.<\/li>\n<\/ul>\n
      java -version\n<\/code><\/pre>\n
      postgresql \uc124\uce58<\/h2>\n
      PostgreSQL 16 \uc124\uce58<\/h3>\n
      [RockyLinux]<\/strong><\/p>\n
      dnf module list postgresql\ndnf module reset postgresql -y\ndnf module enable postgresql:16 -y\ndnf install -y postgresql-server postgresql-contrib\n<\/code><\/pre>\n
      [Debian\/Ubuntu]<\/strong><\/p>\n
      1. \ud544\uc218 \ud328\ud0a4\uc9c0 \uc124\uce58 \ubc0f \uc800\uc7a5\uc18c \ud0a4 \ucd94\uac00<\/h4>\n
      apt update\napt install -y curl ca-certificates gnupg\ninstall -d \/etc\/apt\/keyrings\ncurl -fsSL https:\/\/www.postgresql.org\/media\/keys\/ACCC4CF8.asc | gpg --dearmor -o \/etc\/apt\/keyrings\/postgresql.gpg\n<\/code><\/pre>\n
      2. PostgreSQL \uacf5\uc2dd \uc800\uc7a5\uc18c \ucd94\uac00<\/h4>\n
      echo "deb [signed-by=\/etc\/apt\/keyrings\/postgresql.gpg] http:\/\/apt.postgresql.org\/pub\/repos\/apt $(lsb_release -cs)-pgdg main" | sudo tee \/etc\/apt\/sources.list.d\/pgdg.list\n<\/code><\/pre>\n
      3. PostgreSQL 16 \ubc0f \ubaa8\ub4c8(contrib) \uc124\uce58<\/h4>\n
      apt update\napt install -y postgresql-16 postgresql-contrib-16\n<\/code><\/pre>\n
      PostgreSQL \ucd08\uae30\ud654<\/h3>\n
      [RockyLinux]<\/strong><\/p>\n
      postgres --version\npostgresql-setup --initdb\nsystemctl enable postgresql\ncp -f \/var\/lib\/pgsql\/data\/pg_hba.conf \/var\/lib\/pgsql\/data\/pg_hba.conf.orig\n<\/code><\/pre>\n
      [Debian\/Ubuntu]<\/strong><\/p>\n
      sudo -u postgres psql --version\n<\/code><\/pre>\n
      Postgresql\uc758 IPv4 \uc811\uc18d \ubc29\uc2dd \ubcc0\uacbd<\/h3>\n
      [RockyLinux]<\/strong>\nvi \/var\/lib\/pgsql\/data\/pg_hba.conf<\/code><\/p>\n
      host    all             all             127.0.0.1\/32            ident\n\uc744\nhost    all             all             127.0.0.1\/32            scram-sha-256\n\ub85c \uc218\uc815\n<\/code><\/pre>\n
      systemctl restart postgresql\n<\/code><\/pre>\n
      [Debian\/Ubuntu]<\/strong><\/p>\n
      vi \/etc\/postgresql\/16\/main\/pg_hba.conf\n<\/code><\/pre>\n
      [Debian\/Ubuntu]<\/strong> \uc740 \uc218\uc815 \ud544\uc694 \uc5c6\uc74c.<\/p>\n
      systemctl restart postgresql\n<\/code><\/pre>\n
      Keycloak DB \ubc0f \uacc4\uc815 \uc0dd\uc131<\/h3>\n
      sudo -u postgres psql<\/code><\/p>\n
      CREATE USER u_keycloak WITH PASSWORD 'Pass!234';\nCREATE DATABASE db_keycloak OWNER u_keycloak ENCODING 'UTF8';\n\\l\n\\q\n<\/code><\/pre>\n
      psql -h 127.0.0.1 -U u_keycloak -d db_keycloak<\/code><\/p>\n
      SELECT current_database();\n\\q\n<\/code><\/pre>\n
      postfix \uc124\uce58 (\uc774\uba54\uc77c \ubc1c\uc1a1\uc6a9)<\/h2>\n
      postfix \uc124\uce58<\/h3>\n
      [RockyLinux]<\/strong>\ndnf install -y postfix mailx<\/code><\/p>\n
      [Debian\/Ubuntu]<\/strong>\napt install -y postfix mailutils<\/code> (Internet Site \ud0c0\uc785\uc73c\ub85c \uc124\uce58)<\/p>\n
      postfix \uc124\uc815<\/h3>\n
      \uc124\uc815\ud30c\uc77c\uc5d0\uc11c \uc544\ub798 \ubd80\ubd84\uc744 \uc218\uc815\ud55c\ub2e4.\nvi \/etc\/postfix\/main.cf<\/code><\/p>\n
      myhostname = mail.example.com\nmydomain = example.com\nmyorigin = $mydomain\n\ninet_interfaces = loopback-only\ninet_protocols = ipv4\n\nmydestination = $myhostname, localhost.$mydomain, localhost\n\nrelayhost =\n\nmynetworks = 127.0.0.0\/8\n\nsmtp_tls_security_level = may\nsmtp_tls_loglevel = 1\n<\/code><\/pre>\n
      postfix check\nsystemctl enable postfix\nsystemctl restart postfix\n<\/code><\/pre>\n
      keycloak \uc124\uce58<\/h2>\n
      \ucd5c\uc2e0 \uc555\ucd95 \ud30c\uc77c \ub2e4\uc6b4\ub85c\ub4dc (\ud544\uc694\uc2dc \ubc84\uc804 \ubcc0\uacbd)<\/h3>\n
      cd \/tmp\nKEYCLOAK_VERSION="26.7.2"\nwget "https:\/\/github.com\/keycloak\/keycloak\/releases\/download\/${KEYCLOAK_VERSION}\/keycloak-${KEYCLOAK_VERSION}.tar.gz"\n<\/code><\/pre>\n
      \/opt \ub514\ub809\ud130\ub9ac\uc5d0 \uc555\ucd95 \ud574\uc81c \ubc0f \uc2ec\ubcfc\ub9ad \ub9c1\ud06c \uc0dd\uc131<\/h3>\n
      tar -xvzf keycloak-${KEYCLOAK_VERSION}.tar.gz -C \/opt\/\nln -s \/opt\/keycloak-${KEYCLOAK_VERSION} \/opt\/keycloak\nrm -f keycloak-${KEYCLOAK_VERSION}.tar.gz\n<\/code><\/pre>\n
      \uc0ac\uc6a9\uc790 \uc0dd\uc131<\/h3>\n
      useradd --system --home-dir \/opt\/keycloak --shell \/sbin\/nologin keycloak\nchown -R keycloak:keycloak \/opt\/keycloak-${KEYCLOAK_VERSION}\nchown -R keycloak:keycloak \/opt\/keycloak\nchmod 600 \/opt\/keycloak\/conf\/keycloak.conf\nls -ld \/opt\/keycloak*\n<\/code><\/pre>\n
      Keycloak \uae30\ubcf8 \uc124\uc815<\/h3>\n
      cp -f \/opt\/keycloak\/conf\/keycloak.conf \/opt\/keycloak\/conf\/keycloak.conf.orig\nvi \/opt\/keycloak\/conf\/keycloak.conf\n<\/code><\/pre>\n
      # =========================================================\n# Database\n# =========================================================\ndb=postgres\ndb-username=u_keycloak\ndb-password=Pass!234\ndb-url=jdbc:postgresql:\/\/127.0.0.1:5432\/db_keycloak\n\n# =========================================================\n# HTTP \/ HTTPS\n# =========================================================\nhttp-enabled=true\nhttp-port=8080\nhttp-host=0.0.0.0\n\n# =========================================================\n# Hostname\n# =========================================================\nhostname=https:\/\/sso.example.com\n\n# =========================================================\n# Reverse Proxy\n# 10.10.10.1 : apache-httpd reverse proxy server\n# =========================================================\nproxy-headers=xforwarded\nproxy-trusted-addresses=10.10.10.1\n\n# =========================================================\n# Health \/ Metrics\n# =========================================================\nhealth-enabled=true\nmetrics-enabled=true\n\n# Management interface\nhttp-management-host=127.0.0.1\nhttp-management-port=9000\nhttp-management-scheme=http\n\n# =========================================================\n# Logging\n# =========================================================\nlog=console,file\nlog-level=info\n\nlog-file=\/var\/log\/keycloak\/keycloak.log\nlog-file-rotation-enabled=true\nlog-file-rotation-max-file-size=50M\nlog-file-rotation-max-backup-index=10\n<\/code><\/pre>\n
      keycloak \ub85c\uadf8 \ub514\ub809\ud130\ub9ac \uc0dd\uc131<\/h3>\n
      mkdir -p \/var\/log\/keycloak\nchown keycloak:keycloak \/var\/log\/keycloak\nchmod 750 \/var\/log\/keycloak\n<\/code><\/pre>\n
      keycloak Build<\/h3>\n
      sudo -u keycloak JAVA_HOME=\/opt\/jdk \/opt\/keycloak\/bin\/kc.sh build\nsudo -u keycloak JAVA_HOME=\/opt\/jdk \/opt\/keycloak\/bin\/kc.sh show-config\n<\/code><\/pre>\n
      \ucd08\uae30 \uad00\ub9ac\uc790 \uc0dd\uc131<\/h3>\n
      export KEYCLOAK_BOOTSTRAP_PASSWORD='Pass!234'\nsudo -u keycloak env KEYCLOAK_BOOTSTRAP_PASSWORD="$KEYCLOAK_BOOTSTRAP_PASSWORD" JAVA_HOME=\/opt\/jdk \/opt\/keycloak\/bin\/kc.sh bootstrap-admin user --username admin --password:env KEYCLOAK_BOOTSTRAP_PASSWORD\nunset KEYCLOAK_BOOTSTRAP_PASSWORD\n<\/code><\/pre>\n
      keycloak \uc218\ub3d9 \uc2e4\ud589 \ud14c\uc2a4\ud2b8<\/h3>\n
      sudo -u keycloak JAVA_HOME=\/opt\/jdk \/opt\/keycloak\/bin\/kc.sh start --optimized\nss -lntp | grep -E '8080|9000'\n\uc544\ub798\uc640 \uac19\uc774 \ub098\uc624\uba74 \uc815\uc0c1\n\nLISTEN 0      4096     [::ffff:127.0.0.1]:8080             *:*    users:(("java",pid=1895,fd=199))\nLISTEN 0      4096     [::ffff:127.0.0.1]:9000             *:*    users:(("java",pid=1895,fd=200))\n<\/code><\/pre>\n
        \n
      • \n
        Health Check\ncurl http:\/\/127.0.0.1:9000\/health<\/code><\/p>\n<\/li>\n
      • \n
        Ready \ud655\uc778:\ncurl http:\/\/127.0.0.1:9000\/health\/ready<\/code><\/p>\n<\/li>\n
      • \n
        Live \ud655\uc778:\ncurl http:\/\/127.0.0.1:9000\/health\/live<\/code><\/p>\n<\/li>\n
      • \n
        Metrics \ud655\uc778\ncurl http:\/\/127.0.0.1:9000\/metrics<\/code><\/p>\n<\/li>\n<\/ul>\n
        systemd \uc124\uc815<\/h3>\n
        vi \/etc\/systemd\/system\/keycloak.service<\/code><\/p>\n
        [Unit]\nDescription=Keycloak Identity and Access Management\nDocumentation=https:\/\/www.keycloak.org\/\nAfter=network-online.target postgresql.service\nWants=network-online.target\nRequires=postgresql.service\n\n[Service]\nType=simple\n\nUser=keycloak\nGroup=keycloak\n\nWorkingDirectory=\/opt\/keycloak\n\n# Java\nEnvironment="JAVA_HOME=\/opt\/jdk"\n\n# JVM Heap\nEnvironment="JAVA_OPTS_KC_HEAP=-Xms1g -Xmx4g"\n\nExecStart=\/opt\/keycloak\/bin\/kc.sh start --optimized\n\nRestart=on-failure\nRestartSec=10\n\nTimeoutStartSec=180\nTimeoutStopSec=60\n\nLimitNOFILE=65536\n\n# Security hardening\nPrivateTmp=true\nProtectHome=true\nNoNewPrivileges=true\n\n[Install]\nWantedBy=multi-user.target\n<\/code><\/pre>\n
        systemctl daemon-reload\nsystemctl enable keycloak\nsystemctl restart keycloak\n\n### \ub85c\uadf8 \ud655\uc778\njournalctl -u keycloak\ntail -f \/var\/log\/keycloak\/keycloak.log\n<\/code><\/pre>\n
        \n
        Reverse Proxy \uc11c\ubc84 \uc124\uc815<\/h1>\n
        https \uc778\uc99d\uc11c \uc0dd\uc131<\/h2>\n
        \uc6f9\uc11c\ubc84 \uc778\uc99d\uc11c \uc0dd\uc131<\/h3>\n
        # SSLEngine on\n# SSLProtocol -all +TLSv1.2 +TLSv1.3\n# SSLCertificateFile    \/etc\/ssl\/certs\/keycloak.crt\n# SSLCertificateKeyFile \/etc\/ssl\/private\/keycloak.key\n\nCERT_DIR="\/etc\/ssl\/certs"\nKEY_DIR="\/etc\/ssl\/private"\nDOMAIN="localhost"\nDAYS_VALID=3650\n\n# \ud30c\uc77c\uba85 \uc124\uc815\nKEY_FILE="${KEY_DIR}\/keycloak.key"\nCERT_FILE="${CERT_DIR}\/keycloak.crt"\n\necho "[1\/4] \ub514\ub809\ud130\ub9ac \uc0dd\uc131 \ubc0f \ud655\uc778 \uc911..."\nmkdir -p "$CERT_DIR"\nmkdir -p "$KEY_DIR"\n\necho "[2\/4] \uc790\uccb4 \uc11c\uba85 SSL \uc778\uc99d\uc11c \uc0dd\uc131 \uc911..."\n# OpenSSL \uba85\ub839\uc5b4\ub97c \ud1b5\ud55c \ube44\ub300\ud654\ud615 \uc778\uc99d\uc11c \uc0dd\uc131\nopenssl req -x509 -nodes -days $DAYS_VALID -newkey rsa:2048 \\\n  -keyout "$KEY_FILE" \\\n  -out "$CERT_FILE" \\\n  -subj "\/C=KR\/ST=Seoul\/L=Seoul\/O=Development\/OU=IT\/CN=${DOMAIN}" \\\n  -addext "subjectAltName=DNS:${DOMAIN},IP:127.0.0.1"\n\necho "[3\/4] \ud30c\uc77c \uad8c\ud55c \uc124\uc815 \uc911..."\n# \uac1c\uc778\ud0a4 \ud30c\uc77c\uc740 root\ub9cc \uc77d\uc744 \uc218 \uc788\ub3c4\ub85d \uc81c\ud55c\nchmod 600 "$KEY_FILE"\nchmod 644 "$CERT_FILE"\n<\/code><\/pre>\n
        Reverse Proxy \uc11c\ubc84\ub85c Nginx\ub97c \uc0ac\uc6a9\ud55c \ubc29\ubc95 (\uac19\uc740 \uc11c\ubc84)<\/h2>\n
        Nginx \uc124\uce58<\/h3>\n
        [RockyLinux]<\/strong>\ndnf install -y nginx<\/code><\/p>\n
        [Debian\/Ubuntu]<\/strong>\napt install -y nginx<\/code><\/p>\n
        systemctl enable nginx<\/code><\/p>\n
        Nginx Reverse Proxy \uc124\uc815<\/h3>\n
        [RockyLinux]<\/strong>\nvi \/etc\/nginx\/conf.d\/keycloak.conf<\/code><\/p>\n
        [Debian\/Ubuntu]<\/strong>\nvi \/etc\/nginx\/sites-available\/keycloak.conf<\/code><\/p>\n
        server {\n  listen 80;\n  server_name sso.example.com;\n\n  return 301 https:\/\/$host$request_uri;\n}\n\nserver {\n  listen 443 ssl;\n  server_name sso.example.com;\n\n  ssl_certificate     \/etc\/ssl\/certs\/keycloak.crt;\n  ssl_certificate_key \/etc\/ssl\/private\/keycloak.key;\n\n  ssl_protocols TLSv1.2 TLSv1.3;\n\n  client_max_body_size 20m;\n\n  location \/ {\n    proxy_pass http:\/\/127.0.0.1:8080;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto https;\n    proxy_set_header X-Forwarded-Host $host;\n    proxy_set_header X-Forwarded-Port 443;\n    proxy_connect_timeout 30s;\n    proxy_send_timeout 60s;\n    proxy_read_timeout 60s;\n  }\n}\n<\/code><\/pre>\n
        [Debian\/Ubuntu]<\/strong> \uc0ac\uc774\ud2b8 \ud65c\uc131\ud654<\/h3>\n
        rm -f \/etc\/nginx\/sites-enabled\/keycloak.conf\nln -s \/etc\/nginx\/sites-available\/keycloak.conf \/etc\/nginx\/sites-enabled\/keycloak.conf\n<\/code><\/pre>\n
        Nginx \uc124\uc815 \uac80\uc99d<\/h3>\n
        nginx -t\n<\/code><\/pre>\n
        \uc811\uc18d \ud14c\uc2a4\ud2b8<\/h3>\n
          \n
        • https:\/\/sso.example.com<\/li>\n
        • \uc678\ubd80\uc5d0\ub294 https(443\/tcp) \uc678 \ud3ec\ud2b8\ub294 \uac1c\ubc29\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/li>\n<\/ul>\n
          Reverse Proxy \uc11c\ubc84\ub85c apache2\ub97c \uc0ac\uc6a9\ud55c \ubc29\ubc95 (\ub2e4\ub978 \uc11c\ubc84)<\/h2>\n
            \n
          • 10.10.10.1(apache2) \u2192 10.10.10.143(keycloak)<\/li>\n<\/ul>\n
            apache conf \uc791\uc131<\/h3>\n
            vi \/etc\/apache2\/sites-available\/sso.example.com.conf<\/code><\/p>\n
            <VirtualHost _default_:443>\n  ServerName sso.example.com\n\n  # =====================================================\n  # TLS\n  # =====================================================\n  SSLEngine on\n  SSLCertificateFile  "\/etc\/ssl\/example.com\/fullchain.pem"\n  SSLCertificateKeyFile   "\/etc\/ssl\/example.com\/privkey.pem"\n  SSLProtocol -all +TLSv1.2 +TLSv1.3\n\n  # =====================================================\n  # Reverse Proxy\n  # =====================================================\n  ProxyRequests Off\n  ProxyPreserveHost On\n  ProxyPass        \/ http:\/\/10.10.10.143:8080\/\n  ProxyPassReverse \/ http:\/\/10.10.10.143:8080\/\n\n  # =====================================================\n  # Forwarded Headers\n  # =====================================================\n  RequestHeader set X-Forwarded-Proto "https"\n  RequestHeader set X-Forwarded-Port "443"\n  RequestHeader set X-Forwarded-Host "sso.example.com"\n\n  # =====================================================\n  # Timeout\n  # =====================================================\n  ProxyTimeout 60\n\n  # =====================================================\n  # Logs\n  # =====================================================\n  ErrorLog ${APACHE_LOG_DIR}\/sso.example.com-error.log\n  CustomLog ${APACHE_LOG_DIR}\/sso.example.com-access.log combined\n<\/VirtualHost>\n<\/code><\/pre>\n
            a2ensite sso.example.com.conf\n<\/code><\/pre>\n
            \n
            Keycloak \uae30\ubcf8 \uc124\uc815<\/h1>\n
            \uc124\uc815 \ubc29\ubc95<\/h2>\n
            realm(\uc601\uc5ed) \uc0dd\uc131<\/h3>\n
              \n
            • Manage realms > Create realm\n
                \n
              • Realm name: myrealm (realm \uba85\uc740 \ud55c\uae00 \uae08\uc9c0, \uacf5\ubc31 \uae08\uc9c0)<\/li>\n
              • Enabled: On\n\uc774\uc81c \ubaa8\ub4e0 \uc124\uc815\uc740 \u201cmyrealm\u201d realm \uc5d0\uc11c \uc9c4\ud589 \ub41c\ub2e4.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                \ube44\ubc00\ubc88\ud638 \uc815\ucc45 \uc124\uc815<\/h3>\n
                  \n
                • Authentication > Policies > Password policy\n
                    \n
                  • Minimum length: 10<\/li>\n
                  • Uppercase characters: 1<\/li>\n
                  • Lowercase characters: 1<\/li>\n
                  • Digits: 1<\/li>\n
                  • Special characters: 1<\/li>\n
                  • Not username: ON<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                    Brute Force Detection \ud65c\uc131\ud654<\/h3>\n
                      \n
                    • Realm settings > Security defenses > Brute force detection\n
                        \n
                      • Brute Force Mode: Lockout temporarily<\/li>\n
                      • Max login failures: 5<\/li>\n
                      • Failure reset time: 5 Hours<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                        \uc774\uba54\uc77c \uc124\uc815<\/h3>\n
                          \n
                        • Realm settings > Email<\/li>\n
                        • Template\n\uc801\ub2f9\ud788 \uc124\uc815<\/li>\n
                        • Connection & Authentication\n
                            \n
                          • Host: 127.0.0.1<\/li>\n
                          • Allow UTF-8: Enabled\n\ub098\uba38\uc9c0\ub294 \ubaa8\ub450 \uae30\ubcf8\uac12 \ub610\ub294 OFF<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
                            \uc0ac\uc6a9\uc790 \uc9c1\uc811 \uac00\uc785 \ube44\ud65c\uc131\ud654<\/h3>\n
                              \n
                            • Realm settings > Login<\/li>\n
                            • Login screen customization: \uc544\ub798 \uc678 \ub098\uba38\uc9c0\ub294 \ubaa8\ub450 OFF\n
                                \n
                              • Forgot password: ON (Realm settings > Email \uc124\uc815 \ud544\uc694)<\/li>\n
                              • Remember me: ON<\/li>\n<\/ul>\n<\/li>\n
                              • Email settings: \uc544\ub798 \uc678 \ub098\uba38\uc9c0\ub294 \ubaa8\ub450 OFF\n
                                  \n
                                • Email as username: ON (\uc774\uba54\uc77c\uc744 ID\ub85c \uc0ac\uc6a9)<\/li>\n
                                • Login with email: ON (\uc774\uba54\uc77c\ub85c \ub85c\uadf8\uc778 \uac00\ub2a5)<\/li>\n<\/ul>\n<\/li>\n
                                • User info settings: \ubaa8\ub450 OFF<\/li>\n<\/ul>\n
                                  \uadf8\ub8f9 \uc0dd\uc131<\/h3>\n
                                    \n
                                  • Groups > Create group<\/li>\n
                                  • Name: employees<\/li>\n<\/ul>\n
                                    \uc0ac\uc6a9\uc790 \uc0dd\uc131<\/h3>\n
                                      \n
                                    • Users > Create new user<\/li>\n
                                    • Email verified: ON (\uc774\uba54\uc77c\uc744 \uc2e0\ub8b0\ud568)<\/li>\n
                                    • Username: myid@example.com<\/li>\n
                                    • Email: myid@example.com<\/li>\n
                                    • First name: \uae38\ub3d9<\/li>\n
                                    • Last name: \ud64d<\/li>\n
                                    • Group: Join Groups > employees \uc120\ud0dd<\/li>\n
                                    • Create > Save<\/li>\n<\/ul>\n
                                      \ube44\ubc00\ubc88\ud638 \uc124\uc815<\/h3>\n
                                        \n
                                      • Users > \uc0ac\uc6a9\uc790 \uc120\ud0dd<\/li>\n
                                      • Credentials > Set Password<\/li>\n
                                      • Temporary = OFF (ON\uc73c\ub85c \uc124\uc815\ud558\uba74 \ucd08\uae30 \ub85c\uadf8\uc778 \ud6c4 \ube44\ubc00\ubc88\ud638 \ubcc0\uacbd\ud574\uc57c \ud568)<\/li>\n<\/ul>\n
                                        \uc0ac\uc6a9\uc790 \ub85c\uadf8\uc778 \ud14c\uc2a4\ud2b8<\/h3>\n
                                        https:\/\/sso.example.com\/realms\/myrealm\/account\/<\/p>\n
                                        SAML 2.0 \uc9c0\uc6d0 \uc5ec\ubd80 \ud655\uc778<\/h3>\n
                                        https:\/\/sso.example.com\/realms\/myrealm\/protocol\/saml\/descriptor<\/p>\n
                                        OIDC(OpenID Connect) 1.0 \uc9c0\uc6d0 \uc5ec\ubd80 \ud655\uc778<\/h3>\n
                                        https:\/\/sso.example.com\/realms\/myrealm\/.well-known\/openid-configuration<\/p>\n
                                        OAuth 2.0\/OIDC\uc758 \uae30\ub2a5<\/h3>\n
                                        OAuth 2.0\n   |\n   | Authorization Framework\n   |\n   +--> "\uc774 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc5d0 \uc5b4\ub5a4 \uad8c\ud55c\uc744 \uc904 \uac83\uc778\uac00?"\n\nOIDC\n   |\n   | OAuth 2.0 \uc704\uc5d0 Identity \uacc4\uce35 \ucd94\uac00\n   |\n   +--> "\uc774 \uc0ac\uc6a9\uc790\uac00 \ub204\uad6c\uc778\uac00?"\n\n[OAuth 2.0]\nAccess Token\n     \u2193\nAPI \uc811\uadfc \uad8c\ud55c\n\n[OIDC]\nID Token\n     \u2193\n\uc0ac\uc6a9\uc790 \uc778\uc99d \uc815\ubcf4\n     \u2193\nemail\nname\nsub\n...\n<\/code><\/pre>\n<\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[39,12],"tags":[],"class_list":["post-9128","post","type-post","status-publish","format-standard","hentry","category-os_linux_unix_macos","category-computing_security"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/9128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9128"}],"version-history":[{"count":0,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/9128\/revisions"}],"wp:attachment":[{"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hasu0707.duckdns.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}