When you see the message “You are logged in as a temporary admin user. To harden security, create a permanent admin account and delete the temporary one” in Keycloak, it means that you’ve logged in as a temporary user with admin privileges, typically created during the initial setup of Keycloak. For security reasons, it’s essential to create a permanent admin account and remove the temporary one.

Steps to Create a Permanent Admin Account and Delete the Temporary Admin User:

1. Log in to Keycloak Admin Console:
   • If you are currently logged in as the temporary admin user, use the credentials to access the Keycloak admin console.
2. Create a New Admin User:
   • Navigate to the “Users” section from the left sidebar under “Manage”.
   • Click “Add user” to create a new user account.
   • Fill in the necessary information for the new admin user (e.g., username, email).
   • Set the “Enabled” toggle to ON to activate the account.
3. Assign Admin Role to the New User:
   • Once the user is created, click on the newly created user.
   • Go to the “Role Mappings” tab.
   • Under “Available Roles”, find and assign the “admin” role. This grants the user administrative privileges.
4. Log Out and Log In as the New Admin User:
   • Log out of the current session (the temporary admin user).
   • Log back in using the new permanent admin account you just created.
5. Delete the Temporary Admin User:
   • Once logged in with the new permanent admin account, go back to the “Users” section.
   • Find the temporary admin user (usually named “admin” or something similar).
   • Click on the user and then click “Delete” to remove the temporary admin account.
6. Verify Permissions and Security:
   • Ensure that the new admin user has the necessary privileges and can perform all administrative tasks.
   • Check the “Realm Settings” and ensure that the new admin user can access the configuration options you need.

By following these steps, you will have created a permanent admin user with proper security and removed the temporary admin user, thus hardening the security of your Keycloak setup.