# Keycloak for Linux Remote Desktop: ThinLinc OIDC Setup

**URL:** <https://community.thinlinc.com/t/keycloak-for-linux-remote-desktop-thinlinc-oidc-setup/2078>\
**Category:** Community Support\
**Created:** [15 September 2026 13:31 UTC](https://community.thinlinc.com/t/keycloak-for-linux-remote-desktop-thinlinc-oidc-setup/2078 "2026-09-15T13:31:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hitesh\_Jethva](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/hitesh_jethva/32/799_2.png) [@Hitesh\_Jethva](https://community.thinlinc.com/u/Hitesh_Jethva)\
**Post date:** [15 September 2026 13:31 UTC](https://community.thinlinc.com/t/keycloak-for-linux-remote-desktop-thinlinc-oidc-setup/2078/1 "2026-09-15T13:31:19Z")

</div>

ThinLinc 4.21.0 introduced native OpenID Connect (OIDC) authentication for **ThinLinc Web Access**. This allows you to use an external identity provider such as Keycloak to authenticate users before starting their Linux remote desktop sessions.

With this configuration, users open ThinLinc Web Access in their browser and click **Sign in with Keycloak**. ThinLinc redirects the browser to Keycloak, Keycloak authenticates the user, and ThinLinc maps the returned OIDC username claim to an existing Linux account.

## Prerequisites

Before you begin, you need:

- Ubuntu Server 24.04 LTS.
- Root access or a sudo-enabled user.
- A public IPv4 address.
- DNS records for ThinLinc.
- TCP ports `22`, `80`, and `443` open.
- ThinLinc 4.21.0 or later.

# Part I - Install ThinLinc Server

## Step 1 - Update Ubuntu 24.04

Update the package index:

```auto
sudo apt update

```

Upgrade installed packages:

```auto
sudo apt upgrade -y

```

Install the required packages:

```auto
sudo apt install -y wget unzip curl openssh-server dnsutils nginx certbot python3-certbot-nginx

```

* * *

## Step 2 - Configure the Server Hostname

Set the fully qualified hostname:

```auto
sudo hostnamectl set-hostname thinlinc.linuxbuz.com

```

Verify it:

```auto
hostnamectl
hostname -f

```

Expected output:

```auto
thinlinc.linuxbuz.com

```

* * *

## Step 3 - Create the ThinLinc Administrator User

Create a Linux account:

```auto
sudo adduser thinadm

```

Add it to the sudo group:

```auto
sudo usermod -aG sudo thinadm

```

Verify the account:

```auto
getent passwd thinadm

```

Example output:

```auto
thinadm:x:1000:1000:,,,:/home/thinadm:/bin/bash

```

Switch to the new user:

```auto
su - thinadm

```

Verify sudo access:

```auto
sudo -v

```

* * *

## Step 4 - Add ThinLinc Commands to sudo secure\_path

Open the sudoers file safely:

```auto
sudo visudo

```

Find the `Defaults secure_path` line and add the ThinLinc paths:

```auto
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin:/opt/thinlinc/bin:/opt/thinlinc/sbin"

```

Save and exit.

* * *

## Step 5 - Download ThinLinc Server 4.21.0

Download ThinLinc:

```auto
wget https://www.cendio.com/downloads/server/tl-4.21.0-server.zip

```

Extract it:

```auto
unzip tl-4.21.0-server.zip

```

Enter the extracted directory:

```auto
cd tl-4.21.0-server

```

* * *

## Step 6 - Install ThinLinc Server

Run the installer:

```auto
sudo ./install-server

```

If GTK+ is unavailable, ThinLinc automatically falls back to text mode:

```auto
Could not start GTK+. Using text mode fallback...

```

Press **Enter** when prompted.

The installer detects the ThinLinc package:

```auto
thinlinc-server_4.21.0-4708_amd64.deb

```

Press **Enter** again to install it.

After installation, you should see:

```auto
Installation of ThinLinc completed!

```

When prompted:

```auto
Run ThinLinc setup now [Yes/no]?

```

Enter:

```auto
Yes

```

* * *

## Step 7 - Complete ThinLinc Setup

Accept the license agreement:

```auto
Do you accept the terms of the license agreement [yes/No]? yes

```

Select the first server as the master:

```auto
Server type [Master/agent]? Master

```

Allow ThinLinc to analyze the system.

When prompted for NFS support, select:

```auto
Automatically install the necessary packages [Yes/no]? Yes

```

When prompted for Python LDAP support, select:

```auto
Automatically install the necessary packages [Yes/no]? Yes

```

For the externally reachable address, select:

```auto
hostname

```

ThinLinc should detect:

```auto
thinlinc.linuxbuz.com

```

Enter an administrator email address when requested.

If you do not need printer redirection:

```auto
Configure location-based printer queue (nearest) [Yes/no]? no
Configure client-side printer queue (thinlocal) [Yes/no]? no

```

Install the ThinLinc AppArmor configuration:

```auto
Install AppArmor configuration [Yes/no]? Yes

```

After setup finishes, reboot:

```auto
sudo reboot

```

* * *

## Step 8 - Verify ThinLinc Services

After reboot, check:

```auto
sudo systemctl status vsmserver
sudo systemctl status vsmagent
sudo systemctl status tlwebaccess

```

Each enabled service should show:

```auto
Active: active (running)

```

Verify the agent hostname:

```auto
/opt/thinlinc/bin/tl-config /vsmagent/agent_hostname

```

Expected:

```auto
thinlinc.linuxbuz.com

```

If needed, set it explicitly:

```auto
sudo /opt/thinlinc/bin/tl-config /vsmagent/agent_hostname=thinlinc.linuxbuz.com

```

Restart the agent:

```auto
sudo systemctl restart vsmagent

```

* * *

# Part II - Publish ThinLinc Through Nginx

## Step 9 - Verify ThinLinc Web Access

ThinLinc Web Access normally listens on HTTPS port `300`.

Check it:

```auto
sudo ss -lntp | grep :300

```

* * *

## Step 10 - Configure Nginx for ThinLinc

Create the Nginx site:

```auto
sudo nano /etc/nginx/sites-available/thinlinc

```

Add:

```auto
server {
    listen 80;
    listen [::]:80;

    server_name thinlinc.linuxbuz.com;

    proxy_read_timeout 999h;

    location / {
        proxy_pass https://127.0.0.1:300/;
        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /connect/thinlinc.linuxbuz.com/ {
        proxy_pass https://127.0.0.1:300/;
        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

```

Enable the site:

```auto
sudo ln -s /etc/nginx/sites-available/thinlinc /etc/nginx/sites-enabled/thinlinc

```

Remove the default site:

```auto
sudo rm -f /etc/nginx/sites-enabled/default

```

Test Nginx:

```auto
sudo nginx -t

```

Reload Nginx:

```auto
sudo systemctl reload nginx

```

* * *

## Step 11 - Configure ThinLinc for the Reverse Proxy

Set the public login page:

```auto
sudo /opt/thinlinc/bin/tl-config /webaccess/login_page=https://thinlinc.linuxbuz.com/

```

Trust the local Nginx proxy:

```auto
sudo /opt/thinlinc/bin/tl-config /webaccess/trusted_proxies=127.0.0.1

```

Restart Web Access:

```auto
sudo systemctl restart tlwebaccess

```

* * *

## Step 12 - Configure the Firewall

Allow SSH:

```auto
sudo ufw allow OpenSSH

```

Allow HTTP:

```auto
sudo ufw allow 80/tcp

```

Allow HTTPS:

```auto
sudo ufw allow 443/tcp

```

Enable UFW:

```auto
sudo ufw enable

```

Check the rules:

```auto
sudo ufw status numbered

```

When Nginx handles browser access, port `300` does not need to be exposed publicly.

* * *

## Step 13 - Install a TLS Certificate for ThinLinc

Request a Let’s Encrypt certificate:

```auto
sudo certbot --nginx -d thinlinc.linuxbuz.com

```

Enable HTTPS redirection when prompted.

Test renewal:

```auto
sudo certbot renew --dry-run

```

Open your web browser and verify the ThinLinc web access using the URL:

```auto
https://thinlinc.linuxbuz.com

```

The ThinLinc OIDC redirect URI will be:

```auto
https://thinlinc.linuxbuz.com/

```

* * *

# Part III - Configure Keycloak for ThinLinc

## Step 14 - Open the Keycloak Admin Console

Open the web browser and access your Keycloak Admin Console.

 ![k1](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/6/6526bb85ebce3bc344f13471049543e28e02bd85.png)

Log in with your admin username and password.

* * *

## Step 15 - Create the Keycloak Realm

Click the realm selector and click **Manage**  **realms**.

 ![k2](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/3/354441e28a6253516b3762524dbd07b3eaf1a959.png)

Click on **Create**  **realm**.

 ![k3](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/7/7db26ba7bb930e24d44d861d2ebe534adf29f4ae.png)

Enter Realm name:

```auto
Realm name: thinlinc

```

Leave it enabled and click **Create**.

## Step 16 - Create the ThinLinc User

Open Users from the Keycloak console.

 ![k4](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/3/37d2d0c56beac53d2e0020cad5c1bb8c7f39acbc.png)

Click **Create**  **new**  **user**.

 ![k5](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/c/c79602957eea15735d6c315c25ffe00bc7c76482.png)

Set:

```auto
Username: thinadm

```

Optionally enter:

```auto
Email
First name
Last name

```

For **Required user actions** , leave the field empty for the initial setup.

Set:

```auto
Email verified: Off

```

unless you are actually using email verification.

Click **Create**.

### Set the User Password

Go to **Users** \> **thinadm** \> **Credentials** tab.

 ![k6](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/c/caa4954b825c48429f815887e2a6deadf411f07a.png)

Click **Set**  **password**.

 ![k7](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/d/dbd311d48d2f0cfba3c224245bb25e568615e903.png)

Enter a strong password, set: “ **Temporary: Off** ” and click **Save** to save the password.

For this tutorial:

```auto
Keycloak username = thinadm
Linux username = thinadm

```

* * *

## Step 17 - Create the ThinLinc OIDC Client

On the Keycloak console, click **Client** \> **Create**  **client**.

 ![k8](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/b/b7c93643614c5b294786c02e24b5b311d548a1cf.png)

 ![k9](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/3/3d9242940766c70733cd2e59951e9fff0500247f.png)

Configure the following values:

```auto
Client type: OpenID Connect
Client ID: thinlinc-webaccess
Name: ThinLinc Web Access

```

Click **Next**.

* * *

## Step 18 - Configure the Authentication Flow

 ![k10](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/d/dbdc362083678d980d1c750b98f9fdf9f32c0897.png)

Click **Capability**  **config** and set the following settings:

```auto
Client authentication: On
Standard flow: On

```

Disable options that are not required:

```auto
Direct access grants: Off
Implicit flow: Off
Service accounts roles: Off
Authorization: Off

```

Click **Next**.

* * *

## Step 19 - Configure the Redirect URI

 ![k12](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/e/ef1724a62d813fc04410c71921a2c4965858f40a.png)

Provide your ThinLinc URLs:

```auto
Root URL:https://thinlinc.linuxbuz.com/
Home URL:https://thinlinc.linuxbuz.com/
Valid redirect URIs: https://thinlinc.linuxbuz.com/

```

For this server-side OIDC flow, **Web origins** can normally remain empty.

Click **Save** to the client.

* * *

## Step 20 - Copy the Keycloak Client Secret

Open **Clients** \> **thinlinc-webaccess** \> **Credentials**

 ![k14](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/d/dc1f7402d6cfb3733dd6c3487695a4c624cb7875.png)

Copy the generated **Client secret** and save it for later use.

You now have:

```auto
Client ID:thinlinc-webaccess
Client Secret:<GENERATED_SECRET>

```

Do not publish or paste the client secret into documentation.

* * *

## Step 21 - Verify the Keycloak Realm Endpoint

Open the URL below in your web browser to verify the Keycloak realm endpoint.

```auto
https://your-keycloak-domain/realms/thinlinc/

```

A response similar to the following is normal:

```auto
realm = "thinlinc"
token-service = "https://your-keycloak-domain/realms/thinlinc/protocol/openid-connect"
account-service = "https://your-keycloak-domain/realms/thinlinc/account"

```

This confirms that the realm exists.

However, this is **not** the OIDC discovery endpoint.

* * *

## Step 22 - Verify the OIDC Discovery URL

The correct discovery URL is:

```auto
https://your-keycloak-domain/realms/thinlinc/.well-known/openid-configuration

```

Test it:

```auto
curl -fsSL 'https://your-keycloak-domain/realms/thinlinc/.well-known/openid-configuration' | python3 -m json.tool | head -40

```

You should see values including:

```auto
issuer
authorization_endpoint
token_endpoint
userinfo_endpoint
jwks_uri

```

The issuer should be:

```auto
https://your-keycloak-domain/realms/thinlinc

```

The JWKS endpoint should be similar to:

```auto
https://your-keycloak-domain/realms/thinlinc/protocol/openid-connect/certs

```

Test it:

```auto
curl -fsSL 'https://your-keycloak-domain/realms/thinlinc/protocol/openid-connect/certs' | python3 -m json.tool | head -30

```

* * *

# Part IV - Configure ThinLinc OIDC from the Command Line

## Step 23 - Store the Keycloak Client Secret

Follow the steps below on the ThinLinc server.

Create a protected directory:

```auto
sudo install -d -m 700 -o root -g root /opt/thinlinc/etc/tlwebaccess

```

Read the client secret into a temporary shell variable:

```auto
read -rsp 'Paste Keycloak client secret: ' SECRET
echo

```

Paste the Keycloak client secret and press Enter.

Write it to the file:

```auto
printf '%s' "$SECRET" | sudo tee /opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt >/dev/null

```

Clear the variable:

```auto
unset SECRET

```

Set ownership:

```auto
sudo chown root:root /opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt

```

Set secure permissions:

```auto
sudo chmod 600 /opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt

```

Verify:

```auto
sudo ls -l /opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt

```

Expected permissions:

```auto
-rw------- 1 root root ... keycloak_secret.txt

```

> **Important:** Do not leave this file at mode `644`. The client secret must not be readable by other users.

* * *

## Step 24 - Check the Secret File Safely

You can verify that the file does not contain unwanted whitespace without printing the secret:

```auto
sudo python3 - <<'PY'
p = "/opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt"
data = open(p, "rb").read()

print("Length:", len(data))
print("Ends with newline:", data.endswith(b"\n"))
print("Ends with CRLF:", data.endswith(b"\r\n"))
print("Leading whitespace:", len(data) != len(data.lstrip()))
print("Trailing whitespace:", len(data) != len(data.rstrip()))
PY

```

Ideally:

```auto
Ends with newline: False
Ends with CRLF: False
Leading whitespace: False
Trailing whitespace: False

```

* * *

## Step 25 - Configure the Keycloak OIDC Provider in ThinLinc

Set the username claim:

```auto
sudo /opt/thinlinc/bin/tl-config /webaccess/oidc/keycloak/username_claim=preferred_username

```

Set the Keycloak client ID:

```auto
sudo /opt/thinlinc/bin/tl-config /webaccess/oidc/keycloak/client_id=thinlinc-webaccess

```

Set the client-secret file:

```auto
sudo /opt/thinlinc/bin/tl-config /webaccess/oidc/keycloak/client_secret_path=/opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt

```

Set the Keycloak discovery URL:

```auto
sudo /opt/thinlinc/bin/tl-config '/webaccess/oidc/keycloak/discovery_url=https://your-keycloak-domain/realms/thinlinc/.well-known/openid-configuration'

```

Add the `profile` scope:

```auto
sudo /opt/thinlinc/bin/tl-config /webaccess/oidc/keycloak/scope=profile

```

Set a friendly login button:

```auto
sudo /opt/thinlinc/bin/tl-config '/webaccess/oidc/keycloak/button_text=Sign in with Keycloak'

```

* * *

## Step 26 - Verify the ThinLinc OIDC Configuration

Run:

```auto
sudo /opt/thinlinc/bin/tl-config -Ra /webaccess/oidc/keycloak

```

Expected output:

```auto
button_text = Sign in with Keycloak
scope = profile
discovery_url = https://your-keycloak-domain/realms/thinlinc/.well-known/openid-configuration
client_secret_path = /opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt
client_id = thinlinc-webaccess
username_claim = preferred_username

```

The important parameters are:

```auto
username_claim
discovery_url
client_id
client_secret_path

```

* * *

## Step 27 - Restart ThinLinc Web Access

Restart:

```auto
sudo systemctl restart tlwebaccess

```

Check status:

```auto
sudo systemctl status tlwebaccess --no-pager

```

Expected:

```auto
Active: active (running)

```

* * *

# Part V - Test Keycloak Authentication

## Step 28 - Open ThinLinc Web Access

Open a private or incognito browser window and browse to [https://thinlinc.linuxbuz.com/](https://thinlinc.linuxbuz.com/).

 ![p2](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/2/280b974136cf1029345984724a909e7bc1dfba38.png)

Click on **Sign in with Keycloak,** and the browser should redirect to the Keycloak URL [https://your-keycloak-domain/realms/thinlinc/](https://your-keycloak-domain/realms/thinlinc/).

 ![p3](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/1/1903c87ff9edd1e7e60a8b92af4f95e76d4825fe.png)

Enter the Keycloak credentials below and click **Sign in**.

```auto
Username: thinadm
Password: <Keycloak password>

```

Keycloak authenticates the user and redirects the browser back to [https://thinlinc.linuxbuz.com/](https://thinlinc.linuxbuz.com/).

ThinLinc receives:

```auto
preferred_username=thinadm

```

It then resolves:

```auto
getent passwd thinadm

```

If the account exists and PAM permits access, ThinLinc starts the remote desktop session.

 ![p4](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/c/cbe1c6f811b39d89ca7c841edc99ef214f72b805.jpeg)

* * *

# Part VI - Optional: Disable ThinLinc Password Login

After Keycloak authentication works reliably, you can disable the normal ThinLinc Web Access password form.

Run:

```auto
sudo /opt/thinlinc/bin/tl-config /webaccess/login/password=false

```

Restart:

```auto
sudo systemctl restart tlwebaccess

```

To restore password login later:

```auto
sudo /opt/thinlinc/bin/tl-config /webaccess/login/password=true

```

Restart again:

```auto
sudo systemctl restart tlwebaccess

```

* * *

# Part VII - Troubleshooting

## External Authentication Failed, Try Again

If ThinLinc displays:

```auto
External authentication failed, try again.

```

first verify the OIDC discovery endpoint:

```auto
curl -fsSL 'https://your-keycloak-domain/realms/thinlinc/.well-known/openid-configuration' | python3 -m json.tool | head -40

```

Then verify ThinLinc:

```auto
sudo /opt/thinlinc/bin/tl-config -Ra /webaccess/oidc/keycloak

```

Expected:

```auto
button_text = Sign in with Keycloak
scope = profile
discovery_url = https://your-keycloak-domain/realms/thinlinc/.well-known/openid-configuration
client_secret_path = /opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt
client_id = thinlinc-webaccess
username_claim = preferred_username

```

Check the client-secret file:

```auto
sudo ls -l /opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt

```

Expected:

```auto
-rw------- 1 root root ...

```

Check that it is not empty:

```auto
sudo wc -c /opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt

```

If there is any doubt, copy the current secret again from:

```auto
Keycloak > Clients > thinlinc-webaccess > Credentials

```

and recreate the file.

* * *

## Capture the ThinLinc OIDC Error

Monitor:

```auto
sudo tail -f /var/log/tlwebaccess.log

```

If needed:

```auto
sudo journalctl -u tlwebaccess -f

```

Reproduce the login failure in an incognito browser window.

You can also run:

```auto
sudo grep -Ei 'oidc|error|warning|invalid|claim|authentication' /var/log/tlwebaccess.log | tail -30

```

Common failures include:

```auto
invalid_client

```

```auto
Failed to exchange authorization code

```

```auto
preferred_username claim missing

```

```auto
Could not resolve user

```

Do not share client secrets, authorization codes, access tokens, or ID tokens.

* * *

## Invalid Client Credentials

Verify:

```auto
sudo /opt/thinlinc/bin/tl-config /webaccess/oidc/keycloak/client_id

```

Expected:

```auto
thinlinc-webaccess

```

In Keycloak, verify:

```auto
Client authentication: On

```

If you regenerate the Keycloak client secret, you must update:

```auto
/opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt

```

Then restart:

```auto
sudo systemctl restart tlwebaccess

```

* * *

## Keycloak Login Works but ThinLinc Rejects the User

Check:

```auto
getent passwd thinadm

```

Check:

```auto
id thinadm

```

The mapping must be:

```auto
preferred_username=thinadm
Linux username=thinadm

```

If they do not match, ThinLinc cannot map the authenticated identity to the Linux user.

* * *

## Keycloak Username and Linux Username Are Different

Example:

```auto
Keycloak username: john@example.com
Linux username: john

```

In that case, `preferred_username` will not map directly.

Create an administrator-controlled Keycloak claim such as:

```auto
linux_username

```

with:

```auto
john

```

Then configure ThinLinc:

```auto
sudo /opt/thinlinc/bin/tl-config /webaccess/oidc/keycloak/username_claim=linux_username

```

Restart:

```auto
sudo systemctl restart tlwebaccess

```

Do not use a user-editable claim for Linux account mapping.

* * *

## Sign in With Keycloak Button Does Not Appear

Check:

```auto
sudo /opt/thinlinc/bin/tl-config -Ra /webaccess/oidc/keycloak

```

Verify:

```auto
client_id
client_secret_path
discovery_url
username_claim

```

Restart:

```auto
sudo systemctl restart tlwebaccess

```

Monitor:

```auto
sudo journalctl -u tlwebaccess -f

```

* * *

## ThinLinc Desktop Does Not Start After Authentication

OIDC authentication and Linux account authorization are separate.

Check:

```auto
id thinadm

```

Check password/account status:

```auto
sudo passwd -S thinadm

```

Review ThinLinc logs:

```auto
sudo journalctl -u tlwebaccess -f

```

Review VSM Server logs:

```auto
sudo journalctl -u vsmserver -f

```

Review VSM Agent logs:

```auto
sudo journalctl -u vsmagent -f

```

* * *

## Conclusion

You now have a complete Keycloak and ThinLinc OIDC environment for browser-based Linux remote desktop access.