Skip to main content

​
Steps to set Keyclaok as an OIDC identity provider

1
Navigate to the Clients view within your Keyclaok Dashboard.
2
Click on Create Client.
3
Select OpenID Connect as the Client Type, and give the client a Client IDand a Nameand then click on Next.
Create client form for OpenID Connect with general, capability, and login settings
4
Enable Client authentication, then click on Next and then click on Saveon the next page.
Create client page in Cosmo Docs with client authentication on and authorization off
5
Navigate to the Credentials tab and then copy the Client Secret.
Client Authenticator settings showing client ID, secret, and regenerate option
6
Navigate to the Realm Settings and then copy the link of OpenID Endpoint Configuration.
OpenID and SAML metadata settings with user-managed access turned off
7
Navigate to the settings page on Cosmo.
8
Click on Connect.
Organization settings showing name, slug, and status of AI, RBAC, and SCIM features
9
Give the connection a name, paste the OpenID Endpoint Configuration copied before, into the Discovery Endpoint,and paste the Client ID and Client secretcopied before into the Client ID and Client Secret fields respectively, and then click on Connect.
Connect OpenID Connect Provider form with fields for name, endpoint, and credentials
10
Configure the mapping between the roles in Cosmo and the user groups in Keycloak. The field Group in the provider can be populated with the name of the group or a regex to match the user groups. Once all the mappers are configured, click on Save.
Group mapper configuration dialog linking provider groups to Cosmo roles
11
Copy the sign-in and sign-out redirect URIs displayed in the dialog.
Steps to configure OIDC provider with sign-in and sign-out redirect URLs
12
Navigate back to the client created on Keycloak and populate the Valid redirect URIs and Valid post Logout redirect URIs with the above-copied sign-in and sign-out URLs respectively. Click on Save.
Access settings showing valid redirect and logout URLs fields
13
Navigate to the Client Scopes tab, click on the first client scope(usually would be ${clientID}-dedicated), and then click on Configure a new mapper.
Client scope page showing dedicated mappers section with no mappers added
14
Select Group Membership.
Configure new mapper dialog with Group Membership option for token mapping
15
Give the mapper a name, then populate the Token Claim Name with “ssoGroups” and then click on Save.
16
Now you can assign users/groups to the application, and those users will be able to log into Cosmo using the URL provided on setting up the provider.