@@ -25,45 +25,55 @@ class KeycloakOAuth2(BaseOAuth2): # pylint: disable=abstract-method
25
25
26
26
To set up, please take the following steps:
27
27
28
- 1. Create a new Keycloak client in the Clients section.
28
+ 1. Create a new Keycloak client in the Clients section:
29
+
30
+ a. Choose the `Client ID` in the `General Settings` pane.
31
+
32
+ b. Select `Client authentication` and `Authorization` in the
33
+ `Capability config` pane.
29
34
30
35
2. Configure the following parameters in the Client setup:
31
36
32
37
Settings >
33
38
Client ID (copy to settings as `KEY` value)
34
39
Credentials >
35
40
Client Authenticator >
36
- Secret (copy to settings as `SECRET` value)
41
+ Use `Client Id and Secret` and copy the `Client secret` value
42
+ to settings as `SECRET` value
37
43
38
44
3. For the tokens to work with the JWT setup the following configuration has
39
45
to be made in Keycloak:
40
46
41
- Settings >
42
- Access Type >
43
- confidential
44
- Settings >
45
- Fine Grain OpenID Connect Configuration >
46
- User Info Signed
47
- Response Algorithm >
48
- RS256
49
- Settings >
50
- Fine Grain OpenID Connect Configuration >
51
- Request Object Signature Algorithm > RS256
47
+ Advanced >
48
+ Fine grain OpenID Connect configuration >
49
+ User Info Signed Response Algorithm >
50
+ RS256
51
+ Advanced >
52
+ Fine grain OpenID Connect configuration >
53
+ Request Object Signature Algorithm >
54
+ RS256
55
+
56
+ 4. Re-enable the audience (see https://issues.redhat.com/browse/KEYCLOAK-6638
57
+ for context):
58
+
59
+ Go to Client scopes > YOUR-CLIENT-ID-dedicated > Add mapper > Audience, pick
60
+ a name for the mapper and select the Client ID corresponding to your client
61
+ in `Included Client Audience`.
52
62
53
- 4 . Get the public key (copy to settings as `PUBLIC_KEY` value) to be used
63
+ 5 . Get the public key (copy to settings as `PUBLIC_KEY` value) to be used
54
64
with the backend:
55
65
56
66
Realm Settings > Keys > Public key
57
67
58
- 5 . Configure access token fields are configured via the Keycloak Client
68
+ 6 . Configure access token fields are configured via the Keycloak Client
59
69
mappers:
60
70
61
71
Clients > Client ID > Mappers
62
72
63
73
They have to include at least the `ID_KEY` value and the dictionary keys
64
74
defined in the `get_user_details` method.
65
75
66
- 6 . Configure your web backend. Example setting values for Django settings
76
+ 7 . Configure your web backend. Example setting values for Django settings
67
77
could be:
68
78
69
79
SOCIAL_AUTH_KEYCLOAK_KEY = 'example'
@@ -75,7 +85,7 @@ class KeycloakOAuth2(BaseOAuth2): # pylint: disable=abstract-method
75
85
SOCIAL_AUTH_KEYCLOAK_ACCESS_TOKEN_URL = \
76
86
'https://sso.com/auth/realms/example/protocol/openid-connect/token'
77
87
78
- 7 . The default behaviour is to associate users via username field, but you
88
+ 8 . The default behaviour is to associate users via username field, but you
79
89
can change the key with e.g.
80
90
81
91
SOCIAL_AUTH_KEYCLOAK_ID_KEY = 'email'
0 commit comments