Skip to main content

Create an OIDC federation for Keycloak

  1. Configure federation on the Keycloak side.
  2. Create a federation on the Selectel side.
  3. Add the Selectel federation ID to the Keycloak federation.
  4. If you enabled user auto-creation when creating the federation on the Selectel side, configure user group mapping.

1. Configure federation on the Keycloak side

  1. In the Keycloak control panel, log in to the administrator account (Administration Console).

  2. Go to the Clients section.

  3. Click Create client.

  4. In the General Settings step:

    4.1. In the Client type field, select OIDC.

    4.2. In the Client ID field, enter an identifier for the client that the application will use as the name for the authorization server, for example, mobile-client-v1.

    4.3. Click Next.

  5. In the Capability Config step:

    5.1. Enable the Client Authentication toggle switch.

    5.2. In the Authentication flow block, select the Standard flow checkbox.

    5.3. Click Next.

  6. In the Login settings step:

    6.1. In the Home URL field, enter https://my.selectel.ru/federated-login.

    6.2. In the Valid Redirect URIs field, enter https://api.selectel.ru/v1/auth/federations/oidc/*.

    6.3. Click Save.

2. Create a federation on the Selectel side

  1. In the control panel, in the top menu, click IAM.

  2. Go to the Federations section.

  3. Click Add federation and select OpenID Connect (OIDC).

  4. In the Federation settings block:

    4.1. Enter the federation name.

    4.2. Optional: enter the federation description.

    4.3. Change the session lifetime or leave the default value (24 hours). The session defines the time during which a user remains authorized without the need for re-authentication. You can specify a value from 1 to 720 hours.

    The session lifespan can also be set on the Keycloak provider side in the SSO Session Max or Assertion Lifespan parameter. If the session lifespan is set both in the federation settings and in Keycloak, the lowest value will apply.

  5. In the IDP settings block:

    5.1. In the IdP Issuer field, enter the identity provider ID — https://<idp_url>/realms/master. Specify <idp_url> — your URL with the identity provider.

    5.2. In the Client ID field, enter the ID that you specified in the field Client ID when configuring the federation on the identity provider side in step 1 in step 4.2.

    5.3. In the Client Secret field, enter the secret, can be viewed in the Keycloak control panel in the Client → Client secret.

    5.4. In the Auth URL field, enter the link to the identity provider's login page where users will be redirected for SSO authentication — https://<idp_url>/realms/master/protocol/openid-connect/auth. Specify <idp_url> — your URL with the identity provider.

    5.5. In the Token URL field, enter the token endpoint — https://<idp_url>/realms/master/protocol/openid-connect/token. Specify <idp_url> — your URL with the identity provider.

    5.6. In the JWSK URI field, enter the certificate endpoint — https://<idp_url>/realms/master/protocol/openid-connect/certs. Specify <idp_url> — your URL with the identity provider.

    5.7. To automatically create users when they first log in to the control panel via SSO, select the Automatically create users checkbox.

    If the checkbox is selected, you will need to configure user group mapping. Users will be created with the permissions you specify when configuring mapping. If you enable user auto-creation and do not configure mapping, users will be created without permissions and will not have access to the control panel.

    If you do not select the Automatically create users checkbox, you will need to add users manually.

  6. Click Create Federation.

3. Add the Selectel federation ID to the Keycloak federation

  1. In the Keycloak control panel, log in to the administrator account (Administration Console).
  2. Go to the Clients section.
  3. Open the page of the client you created when configuring federation in step 1.
  4. In the Valid Redirect URIs field, enter https://api.selectel.ru/v1/auth/federations/oidc/<federation_id>/callback. Specify <federation_id> — the federation ID on the Selectel side, which can be viewed in the control panel: in the top menu, click IAM → Federations → federation row → field ID.
  5. Click Save.

4. Configure user group mapping

You must configure group mapping if you enabled user auto-creation when creating the federation on the Selectel side in step 2. Use the Configure group mapping section of the User group mapping instructions.