> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Keycloak Upgrade

With the release of Data Science & AI Workbench 5.6, significant improvements have been made to our Keycloak implementation. For details, please see the [release notes](/docs/data-science/5.7.1/reference/release).

Upgrading to Workbench 5.6 requires Keycloak configuration changes to access your instance. You’ll need to add a service account with correct permissions to the `anaconda-platform` client, then add a protocol mapper to the `roles` client scope.

## Enabling the service account

After your upgrade to Workbench 5.6+ completes:

1. Open a browser and log in to your Keycloak admin panel using your existing Keycloak credentials. Your Keycloak admin panel can be found at `https://<FQDN>auth/admin` where `<FQDN>` is your Workbench fully qualified domain name.
2. Verify you are on the **anaconda-platform** realm.

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/QCWY8EsGZWJYinOU/images/kc_anaconda_platform_realm.png?fit=max&auto=format&n=QCWY8EsGZWJYinOU&q=85&s=8e19bd9bd8c98c214ca46e11d2bbeb9f" alt="" width="1922" height="946" data-path="images/kc_anaconda_platform_realm.png" />
   </Frame>
3. Select **Clients** from the left-hand navigation, then select **anaconda-platform** from the list of available clients.

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/_0MqQ39OoYOKQTk5/images/kc_clients_anaconda_platform.png?fit=max&auto=format&n=_0MqQ39OoYOKQTk5&q=85&s=653a254b9cd8a672b261d81360d42510" alt="" width="1922" height="866" data-path="images/kc_clients_anaconda_platform.png" />
   </Frame>
4. Select the **Service accounts roles** checkbox under **Capability config**, then save your changes.

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/_0MqQ39OoYOKQTk5/images/kc_client_config_service_account_roles.png?fit=max&auto=format&n=_0MqQ39OoYOKQTk5&q=85&s=0805dafbca5f072ae2f9bb8145a0e2a1" alt="" width="1922" height="819" data-path="images/kc_client_config_service_account_roles.png" />
   </Frame>
5. Select the new **Service accounts roles** tab that appears at the top of the page.
6. Click **Assign role**.

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/_0MqQ39OoYOKQTk5/images/kc_assign_service_account_roles.png?fit=max&auto=format&n=_0MqQ39OoYOKQTk5&q=85&s=a9347ccd73a9d009baeb54d40cd8cce5" alt="" width="1922" height="789" data-path="images/kc_assign_service_account_roles.png" />
   </Frame>
7. Open the filter dropdown menu and select **Filter by clients**.

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/_0MqQ39OoYOKQTk5/images/kc_role_filter_options.png?fit=max&auto=format&n=_0MqQ39OoYOKQTk5&q=85&s=6baeffb7ba16cf9e5a3582777aff90e2" alt="" width="1922" height="915" data-path="images/kc_role_filter_options.png" />
   </Frame>
8. Search for the `view-users` role.
9. Select the role, then click **Assign**.

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/_0MqQ39OoYOKQTk5/images/kc_assign_view_users_role.png?fit=max&auto=format&n=_0MqQ39OoYOKQTk5&q=85&s=cab4cd52b68191eb67fba9cfd250c5ce" alt="" width="1922" height="836" data-path="images/kc_assign_view_users_role.png" />
   </Frame>

## Adding the protocol mapper

1. Select **Client scopes** from the left-hand navigation, then select **roles** from the list of available client scopes.

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/_0MqQ39OoYOKQTk5/images/kc_roles_client_scope.png?fit=max&auto=format&n=_0MqQ39OoYOKQTk5&q=85&s=8447e17df06402feae64e69fc427f4a6" alt="" width="1922" height="990" data-path="images/kc_roles_client_scope.png" />
   </Frame>
2. Select the **Mappers** tab.
3. Open the **Add mapper** dropdown menu and select **By configuration**.

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/QCWY8EsGZWJYinOU/images/kc_add_protocol_mapper.png?fit=max&auto=format&n=QCWY8EsGZWJYinOU&q=85&s=824c2b0796e75f6104f70f3972d2c510" alt="" width="1922" height="792" data-path="images/kc_add_protocol_mapper.png" />
   </Frame>
4. Select **Audience**.

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/_0MqQ39OoYOKQTk5/images/kc_audience_mapper.png?fit=max&auto=format&n=_0MqQ39OoYOKQTk5&q=85&s=b2be751ce7b10cf02e0da4381662fbc5" alt="" width="1922" height="1061" data-path="images/kc_audience_mapper.png" />
   </Frame>
5. Complete the fields and set the toggle switches as indicated:

   * **Name**: my-audience
   * **Included Client Audience**: anaconda-platform
   * **Add to ID token**: `ON`
   * **Add to access token**: `ON`
6. Click **Save**.

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/_0MqQ39OoYOKQTk5/images/kc_create_protocol_mapper.png?fit=max&auto=format&n=_0MqQ39OoYOKQTk5&q=85&s=42f822f8987300c32eea60fc2465f91c" alt="" width="1922" height="795" data-path="images/kc_create_protocol_mapper.png" />
   </Frame>

Success! You can now log in to your instance from an existing account and use Workbench normally.