Native users, passwords and groups

Open Server Administration → Identity directory as a verified server administrator. Use Native users and Groups to operate on the deployment's native Keycloak directory.

1. Choose Create native user for a new identity or Edit native user for a verified existing one.
2. Use Set temporary password for a reset. Deliver the temporary value through the approved private channel and have the user complete the first sign-in password change.
3. Use Create group or Edit group for the target group. During creation, the field labeled Stable group ID supplies the Keycloak group name. After creation, use the generated value in the directory's Immutable group ID column for grants and membership.
4. Use Group membership to apply the exact change, then read back the user and membership. Verify the resulting grant with the intended user.

If a user cannot sign in after a reset, verify the issuer, username, current account status and required action. If removal or disablement was intended, verify that access is denied under the current session and grant rules.