FirstSpirit Cloud: User and Access Management, July 2026
Documentation

Managing users in Keycloak

The tasks described on the following page apply regardless of whether you have set up an external identity provider (IdP) in your FirstSpirit Cloud environment.

This page explains how, as a User-Manager, you manage users and groups in Keycloak. You can create and edit users, assign and remove groups, and manage roles.

User management in Keycloak is reserved for users with the role User-Manager. To be able to manage users, the first user with this role must be set up first. You can find the relevant steps under First user: User-Manager on the page User and access rights management with an IdP or User and access rights management without an IdP.

Managing individual user

Creating a new users

If an identity provider is already in use, the users don't need to be created manually. You can continue with the IdP set-up.

  • Open the Users area.

In the Users area, you can only access the tab User list.


  • Click Add User in the upper area.

  • Fill in the fields:

    Field Required Description
    UsernameYesUse only the user's business email address
    EmailNoUse only the user's business email address
    Email verifiedNoChange the verification status to Yes
    First nameNoThe user's first name
    Last nameNoThe user's last name
    GroupsNoSelect the groups the user should belong to. Groups can also be assigned after the user has been created.

    • Click Create to save the user entry.

    Keycloak does not send automatic email notifications to the user. Notify the new user manually that a user entry has been created for them.

    Email template

    You can use the following email template as a basis for your own email and adapt it:

    Hello!

    We’ve created your account for the < TENANT > FirstSpirit Cloud Environment.

    To sign in, you need to activate your account first:

    1. Open the URL https://< TENANT >-account.e-spirit.hosting

    2. Click Forgot Password.

    3. Enter this e-mail address, which represents your FirstSpirit user name.

    4. You will receive an e-mail to set your password (please check your spam folder, just in the case that the confirmation e-mail got delivered there instead of your inbox).

    5. Click the link in the email.
    → You are redirected to your Keycloak account site.

    6. Set your password under Account security > Signing in.

    After setting the password your account is activated. No further e-mail will be sent!

    The stages can be reached via following URLs:

    • Development (DEV) http://< TENANT >dev.e-spirit.hosting
    • Quality Assurance (QA) http://< TENANT >qa.e-spirit.hosting
    • Production (PROD) http://< TENANT >.e-spirit.hosting

    If you have any questions, please feel free to contact me.

    Kind regards,

    Editing user entries

    Once a user is created, you can edit other properties of the user.

    • Open the Users area.
    • Click the username in the Username column. The entry's detailed view will open.

    Keycloak offers a range of functions that go beyond the settings required for the described goals. Edit the settings as described.

    Deleting users

    To delete the user entry:

    • Open the Users area.
    • Select one or more users in the list and click Delete user in the upper area.
    • Alternatively: Click the three-dot-menu in a user entry's row and select Delete.
    • Open the user entry's detailed view. Click Action in the upper area and select Delete.
    • Confirm with Delete.

    Deleted users do not have access to the FirstSpirit Cloud.
    It is not possible to restore a deleted user with the original settings.
    It is not possible to delete users that are not managed by your company (e.g. users from partner organizations or FirstSpirit employees).
    For user control:
    - Deleting user from associated user groups
    - Deleting associated user groups
    - Support request to delete the entire partner realm

    Managing user groups

    Creating user groups

    Typically, the user groups you need to get started with FirstSpirit Cloud are already in place and do not need to be created.

    Newly created user groups will automatically be deleted if they do not contain any users after a pre-set time.

    Assigning users to user groups

    If you use an IdP, you can automate group assignment in Keycloak using Group mapping. Group mapping automatically assigns users to the appropriate Keycloak groups when they log in, based on their group membership in the IdP.

    • Open the Users area.
    • Click on the user entry in the Username column to open the user entry's detailed view.
    • Open the Groups tab.
      In the list, the user's memberships are displayed.
    • Click Join group.
      A pop-up with the list of all available groups is displayed.
    • Select one or more groups and click Join.

    Removing users from user groups

    • Inside a group entry row in the list, click Leave.
    • Alternatively: Select one or more entries in the list and click Leave in the upper area.

    Deleting user groups

    It is not possible for a user manager or any other user role within your company to Delete user groups.

    To delete a user group, create a Support request.

    Managing user roles

    • Open the Users area.
    • In the user entry's detailed view, open the Role Mappings tab. Your realm's roles are displayed.

    Assigning the role User-Manager

    As a user manager, you can assign another user the User-Manager role.

    In Keycloak:

    • Navigate to the section Users > Role mapping.
    • In the upper area, click Assign role > Realm roles.
    • In the pop-up, select the User-Manager role and click Assign.
      The role is assigned instantly.

    The role User-Manager should only be assigned to persons with a user management function in the company. Depending on the company structure this can be a department, division or project manager, or the IT department.

    Assigning the role password-user

    As a user manager, you can assign the role password-user to a user to enable local authentication.

    In Keycloak:

    • Navigate to the section Users.
    • Open the details view for the desired user and go to the Role Mapping tab.
    • Click Assign role and select Realm role.
    • Select the role password-user.

    The role can also be assigned to a group. To do this, go to the Groups section, open the details view for the desired group, and follow the same procedure.

    Unassigning a role

    As a user manager, you can unassign roles from another user.

    • Go to Users > Role mapping.
    • Select a role from the list and click Unassign at the top of the page.
    • Alternatively: Click the three-dot menu in the role's row and select Unassign.
    • Confirm by clicking "Remove.

    It is technically possible to remove the role User-Manager from yourself. If you are the only user manager in your company, the company will lose control over user management. To have the User-Manager role assigned to a user, contact FirstSpirit Support.

    Creating a federation

    Each FirstSpirit partner company has exactly one realm. If you wish your partner to work on your projects, your realm needs to be connected to that of your partner's.

    Creating a federation needs to be requested by the customer with the FirstSpirit Support. The partner company cannot request to create a federation.

    Place your support request with support@firstspirit.com and provide the user information:

    • Partner company's name
    • Name or ID of one or more users in your company that shall have the User-Manager role

    Or create a ticket.

    Table of Contents