---
title: "Create an OIDC federation for Keycloak"
sidebar_label: "Create an OIDC federation for Keycloak"
sidebar_position: 1
description: "How to configure federation on the Selectel side and the Keycloak identity provider using the OIDC protocol"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import CreateFederationForSelectel from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/access-control/federations/manage-oidc/create-federation-for-selectel.mdx'

# Create an OIDC federation for Keycloak

1. [Configure federation on the Keycloak side](#configure-federation-for-identity-provider).
2. [Create a federation on the Selectel side](#create-federation-for-selectel).
3. [Add the Selectel federation ID to the Keycloak federation](#add-selectel-federation-id-to-keycloak).
4. If you enabled automatic user creation when creating the federation on the Selectel side, [configure user group mapping](#configure-mapping).

## 1. Configure federation on the Keycloak side \{#configure-federation-for-identity-provider}

1. In the Keycloak control panel, log in to the administrator account (Administration Console).

2. Go to the **Clients** section.

3. Click **Create client**.

4. At the **General Settings** step:

   4.1. In the **Client type** field, select **OIDC**.

   4.2. In the **Client ID** field, enter a client identifier that the application will use as a name for the authorization server, for example, `mobile-client-v1`.

   4.3. Click **Next**.

5. At the **Capability Config** step:

   5.1. Enable the **Client Authentication** toggle.

   5.2. In the **Authentication flow** block, select the **Standard flow** checkbox.

   5.3. Click **Next**.

6. At the **Login settings** step:

   6.1. In the **Home URL** field, enter `https://my.selectel.ru/federated-login`.

   6.2. In the **Valid Redirect URIs** field, enter `https://api.selectel.ru/v1/auth/federations/oidc/*.`.

   6.3. Click **Save**.

## 2. Create a federation on the Selectel side \{#create-federation-for-selectel}

<CreateFederationForSelectel KeycloakSession="Время жизни сессии также можно установить on стороне провайдера Keycloak in параметре SSO Session Max or Assertion Lifespan. Если время жизни сессии установлено and in настройках федерации, and in Keycloak, будет применяться наименьшее значение." IdIssuer="https://<idp_url>/realms/master" ClientIdSpecify="указали in поле" ClientIdField="Client ID" ClientSecretGet="можно посмотреть in панели управления Keycloak in разделе " ClientSecretFields="Client → Client secret" AuthUrl="https://<idp_url>/realms/master/protocol/openid-connect/auth" TokenUrl="https://<idp_url>/realms/master/protocol/openid-connect/token" JwskUri="https://<idp_url>/realms/master/protocol/openid-connect/certs" Step="4.2" />

## 3. Add the Selectel federation ID to the Keycloak federation \{#add-selectel-federation-id-to-keycloak}

1. In the Keycloak control panel, log in to the administrator account (Administration Console).
2. Go to the **Clients** section.
3. Open the page for the client you created when [configuring the federation in step 1](#configure-federation-for-identity-provider).
4. In the **Valid Redirect URIs** field, enter `https://api.selectel.ru/v1/auth/federations/oidc/<federation_id>/callback`. Specify `<federation_id>` — the federation ID on the Selectel side, which can be found in the [Control panel](https://my.selectel.ru/iam/federations): in the top menu, click **IAM** → **Federations** → federation row → **ID**.
5. Click **Save**.

## 4. Configure user group mapping \{#configure-mapping}

Group mapping must be configured if you enabled automatic user creation during [creation of a federation on the Selectel side at step 2](#create-federation-for-selectel). Use the [Configure group mapping](/access-control/groups/mapping.mdx#configure-group-mapping) subsection of the [User group mapping](/access-control/groups/mapping.mdx) guide.

<Formbricks />