You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/admin/configuration/authentication-and-user-management/keycloak.md
+14-9Lines changed: 14 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,6 +8,7 @@ title: Keycloak Integration
8
8
9
9
OpenCloud supports using Keycloak as an external identity provider, providing enterprise-grade identity management capabilities. This guide explains how to set up and configure Keycloak with OpenCloud.
10
10
This guide is divided into three main sections:
11
+
11
12
-**[Keycloak Integration Overview](#opencloud-configuration-for-keycloak-general)**: A brief overview of the integration process.
12
13
-**[Shared User Directory Mode](#configuration-for-shared-directory-mode)**: Keycloak and OpenCloud share a common LDAP directory for user management.
13
14
-**[Autoprovisioning Mode](#configuration-for-autoprovisioning-mode)**: OpenCloud autoprovisions users in a separate LDAP directory managed by OpenCloud.
@@ -50,12 +51,12 @@ If you need to manually configure the clients in Keycloak:
50
51
3. Navigate to Clients and click Create
51
52
4. Configure each client according to the specifications above
52
53
5. Ensure all clients have the appropriate scopes:
In this mode, a readable LDAP Directory with existing users serves as a central user directory for both Keycloak and OpenCloud.
99
99
100
100
**Key characteristics:**
101
+
101
102
- LDAP is the source of truth for user information
102
103
- The LDAP server uses standard attributes (uid, cn, sn, givenName, mail)
103
104
- A common unique identifier (e.g. `entryUUID` or `objectGUID`) guarantees stable user mapping even if users are changing
@@ -115,6 +116,7 @@ OpenCloud can work with any LDAP schema containing standard attributes:
115
116
- Default configuration sets LDAP as read-only
116
117
117
118
**Example LDAP Structure:**
119
+
118
120
```bash
119
121
dc=example,dc=org # Base DN
120
122
├── ou=users # User organizational unit
@@ -184,6 +186,7 @@ OpenCloud provides complete example deployments using Docker Compose:
184
186
2. Edit the `.env` file to enable the Shared Directory Mode:
185
187
186
188
**For Shared Directory Mode:**
189
+
187
190
```bash
188
191
# Enable services
189
192
LDAP=:ldap.yml
@@ -202,6 +205,7 @@ Keycloak is configured during startup by importing the `keycloak-realm.dist.json
202
205
Keycloak can import the realm configuration file **only once** during the first startup. If you need to change the configuration, you must delete the Keycloak container and volume and restart it. This will reset Keycloak to its initial state.
203
206
204
207
:::
208
+
205
209
## Autoprovisioning Mode
206
210
207
211
In this mode, Keycloak is holding all users and OpenCloud autoprovisions new users during first login.
@@ -289,6 +293,7 @@ OpenCloud provides complete example deployments using Docker Compose:
289
293
2. Edit the `.env` file to enable the Autoprovisioning Mode:
290
294
291
295
**For Autoprovisioning Mode:**
296
+
292
297
```bash
293
298
# Enable services
294
299
LDAP=:ldap.yml
@@ -311,8 +316,8 @@ Keycloak can import the realm configuration file **only once** during the first
311
316
312
317
Common issues and solutions:
313
318
314
-
-**User cannot log in**:
315
-
- Check LDAP connectivity and user existence
319
+
-**User cannot log in**:
320
+
- Check LDAP connectivity and user existence
316
321
- Check if each user has an OpenCloud Role assigned
317
322
- Verify that the client IDs and redirect URIs match exactly
318
323
-**Groups not synchronized**: Verify group mappings in Keycloak
0 commit comments