KeyCloak Azure Federation - Revision history

Qadmin: /* 2. Set Up Azure AD as an Identity Provider in Keycloak */

2025-04-17T02:29:52Z

2. Set Up Azure AD as an Identity Provider in Keycloak

← Older revision		Revision as of 02:29, 17 April 2025
Line 44:		Line 44:
	# Save the configuration.		# Save the configuration.
	# Sync mode should be set to either 'FORCE' or 'IMPORT' based on your use case needs.		# Sync mode should be set to either 'FORCE' or 'IMPORT' based on your use case needs.
			[[File:Force-sync-mode.png\|1288x1288px]]

	== 3. Authenticate into Keycloak Using Azure Credentials ==		== 3. Authenticate into Keycloak Using Azure Credentials ==

2025-04-17T02:25:38Z

1. Configure Azure AD as an OpenID Connect (OIDC) Provider

← Older revision		Revision as of 02:25, 17 April 2025
Line 27:		Line 27:
	https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration		https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration
	[[File:Overview.png\|1288x1288px]]		[[File:Overview.png\|1288x1288px]]
	* Add API permission scopes 'openid', 'email', and 'profile' for ~~the Azure IDP~~		* Add API permission scopes 'openid', 'email', and 'profile' for 'Microsoft Graph'
	[[File:API-scopes.png\|1288x1288px]]		[[File:API-scopes.png\|1288x1288px]]

2025-04-17T02:18:57Z

1. Configure Azure AD as an OpenID Connect (OIDC) Provider

← Older revision		Revision as of 02:18, 17 April 2025
Line 28:		Line 28:
	[[File:Overview.png\|1288x1288px]]		[[File:Overview.png\|1288x1288px]]
	* Add API permission scopes 'openid', 'email', and 'profile' for the Azure IDP		* Add API permission scopes 'openid', 'email', and 'profile' for the Azure IDP
			[[File:API-scopes.png\|1288x1288px]]

	== 2. Set Up Azure AD as an Identity Provider in Keycloak ==		== 2. Set Up Azure AD as an Identity Provider in Keycloak ==

2025-04-17T02:15:16Z

1. Configure Azure AD as an OpenID Connect (OIDC) Provider

← Older revision		Revision as of 02:15, 17 April 2025
Line 27:		Line 27:
	https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration		https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration
	[[File:Overview.png\|1288x1288px]]		[[File:Overview.png\|1288x1288px]]
			* Add API permission scopes 'openid', 'email', and 'profile' for the Azure IDP

	== 2. Set Up Azure AD as an Identity Provider in Keycloak ==		== 2. Set Up Azure AD as an Identity Provider in Keycloak ==

2025-04-17T02:11:19Z

2. Set Up Azure AD as an Identity Provider in Keycloak

← Older revision		Revision as of 02:11, 17 April 2025
Line 41:		Line 41:
	#* '''Redirect URI''': should match Azure’s app registration		#* '''Redirect URI''': should match Azure’s app registration
	# Save the configuration.		# Save the configuration.
	~~# Add client scopes 'openid', 'email', and 'profile'.~~
	# Sync mode should be set to either 'FORCE' or 'IMPORT' based on your use case needs.		# Sync mode should be set to either 'FORCE' or 'IMPORT' based on your use case needs.

2025-04-17T02:07:11Z

2. Set Up Azure AD as an Identity Provider in Keycloak

← Older revision		Revision as of 02:07, 17 April 2025
Line 41:		Line 41:
	#* '''Redirect URI''': should match Azure’s app registration		#* '''Redirect URI''': should match Azure’s app registration
	# Save the configuration.		# Save the configuration.
	#* Add client scopes 'openid', 'email', and 'profile'.		# Add client scopes 'openid', 'email', and 'profile'.
	#* Sync mode should be set to either 'FORCE' or 'IMPORT' based on your use case needs.		# Sync mode should be set to either 'FORCE' or 'IMPORT' based on your use case needs.

	== 3. Authenticate into Keycloak Using Azure Credentials ==		== 3. Authenticate into Keycloak Using Azure Credentials ==

2025-04-17T02:06:49Z

2. Set Up Azure AD as an Identity Provider in Keycloak

← Older revision		Revision as of 02:06, 17 April 2025
Line 41:		Line 41:
	#* '''Redirect URI''': should match Azure’s app registration		#* '''Redirect URI''': should match Azure’s app registration
	# Save the configuration.		# Save the configuration.
			#* Add client scopes 'openid', 'email', and 'profile'.
			#* Sync mode should be set to either 'FORCE' or 'IMPORT' based on your use case needs.

	== 3. Authenticate into Keycloak Using Azure Credentials ==		== 3. Authenticate into Keycloak Using Azure Credentials ==

2025-04-14T23:57:34Z

2. Set Up Azure AD as an Identity Provider in Keycloak

← Older revision		Revision as of 23:57, 14 April 2025
Line 32:		Line 32:
	# Log into the Keycloak Admin Console.		# Log into the Keycloak Admin Console.
	# Navigate to your realm or create a new one. > '''Identity Providers''' > '''Add provider''' > '''OIDC'''.		# Navigate to your realm or create a new one. > '''Identity Providers''' > '''Add provider''' > '''OIDC'''.
			[[File:Kc-idc-provider-azure.png\|1288x1288px]]
	# Fill in the following:		# Fill in the following:
	#* '''Alias''': <code>azuread</code>		#* '''Alias''': <code>azuread</code>

2025-04-14T23:49:01Z

2. Set Up Azure AD as an Identity Provider in Keycloak

← Older revision		Revision as of 23:49, 14 April 2025
Line 31:		Line 31:

	# Log into the Keycloak Admin Console.		# Log into the Keycloak Admin Console.
	# Navigate to your realm > '''Identity Providers''' > '''Add provider''' > '''OIDC'''.		# Navigate to your realm or create a new one. > '''Identity Providers''' > '''Add provider''' > '''OIDC'''.
	# Fill in the following:		# Fill in the following:
	#* '''Alias''': <code>azuread</code>		#* '''Alias''': <code>azuread</code>

2025-04-14T23:10:45Z

3. Authenticate into Keycloak Using Azure Credentials

← Older revision		Revision as of 23:10, 14 April 2025
Line 49:		Line 49:
	* You will be redirected to the Azure login screen.		* You will be redirected to the Azure login screen.
	* After authentication, a federated Keycloak user is created or linked.		* After authentication, a federated Keycloak user is created or linked.
			* Set a password for your new user. Save the username and password which will be used to acquire access tokens.
			[[File:Set-password.png\|1288x1288px]]

	== Result ==		== Result ==
	Now you can use Keycloak as an OIDC provider for Ceph RGW STS. Using the federated Keycloak User credentials, we can now get access tokens from key cloak to perform object storage operations ([https://wiki.osnexus.com/index.php?title=KeyCloak_Integration#Ceph_RADOSGW see] for an explanation on how to configure Ceph RGW STS). You will find some helpful examples and scripts in [https://github.com/OSNEXUS/KeyCloak-w-Ceph-RADOSGW this] git repository.		Now you can use Keycloak as an OIDC provider for Ceph RGW STS. Using the federated Keycloak User credentials, we can now get access tokens from key cloak to perform object storage operations ([https://wiki.osnexus.com/index.php?title=KeyCloak_Integration#Ceph_RADOSGW see] for an explanation on how to configure Ceph RGW STS). You will find some helpful examples and scripts in [https://github.com/OSNEXUS/KeyCloak-w-Ceph-RADOSGW this] git repository.