Setting up the Keycloak che-username-readonly theme for the Eclipse Che login page

The following procedure is relevant for all Che instances with the OpenShift OAuth service enabled.

When a user with pre-created namespaces logs in to Eclipse Che Dashboard for the first time, a page allowing the user to update account information is displayed. It is possible to change the username, but choosing a username that doesn’t match the OpenShift username, prevents the user’s workspaces from running. This is caused by Che attempts to use a non-existing namespace, the name of which is derived from a user OpenShift username, to create a workspace. To prevent this, log in to Keycloak and modify the theme settings.

Logging in to Keycloak

The following procedure describes how to log in to Keycloak, which acts as a route for OpenShift platforms. To log in to Keycloak, a user has to obtain the Keycloak URL and a user’s credentials first.

  • The kubectl tool installed.

  • Logged in to OpenShift cluster using the kubectl tool.

  1. Obtain a user Keycloak login:

    kubectl get secret che-identity-secret  -n eclipse-che -o json | jq -r '.data.user' | base64 -d
  2. Obtain a user Keycloak password:

    kubectl get secret che-identity-secret  -n eclipse-che -o json | jq -r '.data.password' | base64 -d
  3. Obtain the Keycloak URL:

    kubectl  get ingress -n eclipse-che -l app=che,component=keycloak   -o 'custom-columns=URL:.spec.rules[0].host' --no-headers
  4. Open the URL in a browser and log in to Keycloak using the obtained login and password.

Setting up the Keycloak che-username-readonly theme

  • An instance of Che running in OpenShift.

  • A user is logged in to the Keycloak service.


After changing a username, set the Login Theme option to readonly.

  1. In the main Configure menu on the left, select Realm Settings:

    che keycloak username readonly theme
  2. Navigate to the Themes tab.

  3. In the Login Theme field, select the che-username-readonly option and click the Save button to apply the changes.