Keycloak Tutorial #16 - External Identity Provider Integration

Integrate an external identity provider via OpenID Connect protocol.
This is the 16th video (External Identity Provider Integration) of a video series on Keycloak identity & access management system. This video explains on how to integrate identity provider with keycloak via OIDC protocol.

[@guilhermemunizsantos]

thank you very much for demonstrating how to integrate two keycloak, it saved me a lot of research time.

[@user-uq7hg9zw5j]

Excellent tutorial!!

[@user-mv8gl5ez2y]

Ohhhhhh! Thanks for your video!!! It is suuuuuuuuuuuper helpful for me to understand identity provider!!!!!!!!!!!!!!!!!!!

[@pradhanparesh2010]

Finally it’s working

[@mukunds3144]

Thanks for your video. Could you please tell where to find the video that explains how to integrate app with Identity Broker? It is not mentioned in the description.

[@zer08914]

hi, I'm new to this but can you integrate a new app made with Keycloak with some existing apps which all use OAM as a common login method? Is there a way to instruct Keycloak to use OAM for login? Thanks!

[@felicecoppola9028]

Hi, nice video but there any materials about integration between Keycloak and NAM NetIQ via SAML protocol? Or something via SAML protocol between keycloak and other IdP?

[@pradhanparesh2010]

Hi , I have created an external IDP using java and uploaded the jar file to jboss server. I can see my new external IDP. I want to pass query parameter (iss and launch) to my external IDP. Do you know how to forward query parameters to external identity provider using Keycloak?

[@keycloakuser4716]

@hexaDefence I am trying to set this up locally on my machine. In your setup, when the user was trying to sign-in, you started at port 8081 (which is the spring app). This took you to the identity broker at port 8080. You then clicked on the 'keycloak-idp' option and it took you to port 8000. This is the SP initiated workflow. Did you get the IDP initiated workflow to work? Meaning, the workflow starts by logging on to Identity provider (port 8000). Then the user will click on the client URL (the client that you created in the IDP). On clicking the URL, the user should be taken to the identity broker and then to the spring application (user should be logged in). Does that work for you?

[@hexadefence]

Replied to your other comment.

[@diptochandra]

can you please provide an example to access aws Grafana SAML2.0 integrate with Keycloak user to access Grafana Dashboard without Kubernetes cluster?

[@pradhanparesh2010]

How to setup response type and redirect uri in external idp?

[@martinp3839]

Hi, excellent videos. Can the form that shows up on the Broker for a new user after the IDP does a redirect be avoided? How? Can this process be automated for Bulk users? or using Postman? Thanks.

[@hexadefence]

If those required fields can be extracted from the SAML response, or if you can hard code them using a mapper , then you can avoid the intermediate form

[@vikashkumar-gv1dp]

Can you please explain the token flow between idp and broker and application also

[@pradhanparesh2010]

Nice video..How are you running two Keycloak locally? I am using -Djboss.socket.binding.port-offset=100 two servers running 8080 and 8180 but the second one not creating user admin.

[@hexadefence]

Thanks for the question. I am using docker to run keycloak.

[@akhlaquealam3205]

I am also trying to run two Keycloak in local I am not using any docker, but not able to run

[@hexadefence]

Hi, You need to change few ports in configuration xml file. Thank you

[@pablocopa3605]

Hi @hexaDefence. In this video. Whose responsibility is it to generate the token? Is it the broker's or the IDP's? I'm trying to implement the flow with SAML, but I need the broker to be the one issuing the assertion.

[@hexadefence]

Broker relies on the tokens (oidc) or assertions (saml)generated by the identity provider. You need to connect your application with the broker and your app relies on the tokens or assertions generated by the broker. (Broker is acting as the identity provider for your app because your app doesn't know about any other identity providers except the connected one)

[@papeacendiaye4900]

Nice tutorial can you do please a tutorial Moodle with authentication with keycloak? it would be very interesting

[@hexadefence]

Thanks for the request.

[@mahenderboini5179]

Hi , thanks for the explaination , i wanted to use certificate instead of client secreat, if it is possible, could you please let me know the details

[@hexadefence]

Thanks for the request. Will create a video on this

[@Aria8702]

your video is very good. I was looking for the same scenario. Is it possible to skip the Identity broker login screen and directly land on the IDP login page ?

[@hexadefence]

Thanks for the question. Are you using SAML or OpenID Connect protocol?

[@henoktechie6289]

Yes, It's possible. Just go ahead and change the authorization code flow directly to your IDP in your running keycloak admin instance.

[@nityanandagohain4154]

Hi thank you for these amazing videos, can you please make a tutorial on how to add google as identity provider via saml ?

[@hexadefence]

Hi Nityananda, Thanks for the request. Will create a one in future.

[@krishnapriyavenugopal3072]

Could you please upload a video about to exchange external token to internal in keycloak by using Azure AD. Thank you !

[@hexadefence]

Hi, Is your requirement to use Azure AD as an identity provider for keycloak? Thank you

[@krishnapriyavenugopal3072]

Hi @@hexadefence , Yes. Azure Ad is my requirement. But not necessary to use AzureAD. I just want to study how to exchange an external token to internal in Keycloak. Thank you.!

[@pradhanparesh2010]

One final question in the access token the issuer value is - broker-8080 or provider 8000?

[@hexadefence]

Ultimately the service provider application will receive a token generated by the broker. Token generated by identity provider will be consumed by the broker.

[@pradhanparesh2010]

@@hexadefence Thank you so much!

[@furkanbezci5202]

I am working with keycloak these days. There is sign in with saml in my keycloak login. When I click saml it redirects me to a custom login page. My boss wants to see that login page in popover instead of redirected login page. I am not sure whether it is possible or not :/ Can you help me please ?

[@hexadefence]

I ll get back to you on this. Thank you.

[@MirzaArshadBeg-fu3qu]

@hexadefence, please connect us regarding keycloak implementation

[@srhatfield]

I would like for KeyCloak to act only as a pure Identity Broker and to not store any user information. Is there a way to automatically redirect the user to the Identity Provider without requiring them to see a custom login page and click the "or sign in with" link? And then is there a way to not prompt the user for their additional information?

[@hexadefence]

Are you aware about the idp hint in Keycloak. Perhaps it might help you. It is possible to hide the additional information page by modifying authentication flows.

[@YuJie567]

hmm can this interface with forgerock? with keycloak in the middle

[@hexadefence]

It is possible with any iam which support SAML or oidc

[@user-vq5ts4mq6m]

hi , how you had changed the port number of identity provider as 8000

[@hexadefence]

I am using docker most of the times

[@abhishek_blogs2]

Hi Sir how can we integrate keycloak with kubernates cluster

[@hexadefence]

Hi Abhishek, thanks for the message. Do you want to deploy keycloak as a k8s pod or secure the k8s cluster using keycloak?

[@abhishek_blogs2]

@@hexadefence thanks for the reply, no i have already deployed keycloak in k8s , now i want to create a group of users in keycloak and that should be integrate with k8s with assigned roles , so that group of user can be able to access particular namespace, resource and verbs, as RBAC

[@pradhanparesh2010]

It is not working for me.. it is showing me Update account Information..

[@hexadefence]

Updating user information is a part of the flow. You can skip that step if you want

[@pradhanparesh2010]

@@hexadefence How to skip update information?