Skip to main content

Configure Keycloak as an Identity Provider in ZITADEL

This guides shows you how to connect Keycloak as an identity provider in ZITADEL.

info

In ZITADEL you can connect an Identity Provider (IdP) like Keycloak to your instance and provide it as default to all organizations. Also, you can register the IdP to a specific organization only. If you allow so, your organizations members can do the same in self-service.

Keycloak Configuration​

Register a new client​

  1. Login to your Keycloak account and go to the clients list: <$KEYCLOAK-DOMAIN/auth/admin/$REALM/console/#/$REALM/clients>
  2. Click on "Create Client"
  3. Choose OpenID Connect as Client Type and give your client an ID
  4. Enable Client authentication and the standard flow and direct access grants as authentication flow
  5. Add the valid redirect URIs
  • {your-domain}/ui/login/login/externalidp/callback
  • Example redirect url for the domain https://acme-gzoe4x.zitadel.cloud would look like this: https://acme-gzoe4x.zitadel.cloud/ui/login/login/externalidp/callback
  1. Go to the credentials tab and copy the secret

Add new OIDC Client in Keycloak Get Client Secret

ZITADEL configuration​

Add custom login policy​

The login policy can be configured on two levels. Once in the default settings and this can be overwritten for each organization. The only difference is where you configure it. Go either to the settings page of a specific organization or to the default settings page. Default Settings: $YOUR-DOMAIN/ui/console/instance?id=general Organization: Choose the organization in the menu and go to $YOUR-DOMAIN/ui/console/org-settings?id=login

  1. Go to the Settings
  2. Modify your login policy in the menu "Login Behavior and Security"
  3. Enable the attribute "External Login allowed"

You can also change the settings through the API directly either in the default settings or on a specific organization:

Allow External IDP

Go to the IdP providers overview​

Go to the settings page of your instance or organization and choose "Identity Providers".

In the table you can see all the providers you have configured. Also, you see all provider templates that are available.

Identity Provider Overview

Select the Generic OIDC Provider template.

Create a new generic OIDC provider​

The Generic OIDC Provider allows you to configure any OIDC compliant identity providers.

The following information you need to fill out by yourself:

  • Name : e.g. Keycloak
  • Issuer : The domain where your Keycloak can be reached with the path /auth/realms/$REALM, Example: https://lemur-0.cloud-iam.com/auth/realms/acme
  • Client-ID : Client id from the client previously created in your Keycloak account
  • Scopes: (openid, profile, email is preconfigured)

    • Automatic creation: If this setting is enabled the user will be created automatically within ZITADEL, if it doesn't exist.

    Automatic update: If this setting is enabled, the user will be updated within ZITADEL, if some user data is changed withing the provider. E.g if the lastname changes on the Keycloak account, the information will be changed on the ZITADEL account on the next login.

    Account creation allowed: This setting determines if account creation within ZITADEL is allowed or not.

    Account linking allowed: This setting determines if account linking is allowed. When logging in with a Keycloak account, a linkable ZITADEL account has to exist already.

    info

    Either account creation or account linking have to be enabled. Otherwise, the provider can't be used.

    Keycloak Provider

    Activate IdP​

    Once you created the provider, it is listed in the providers overview. Activate it by selecting the tick with the tooltip set as available.

    If you deactivate a provider, your users with links to it will not be able to authenticate anymore. You can reactivate it and the logins will work again.

    The provider can also be activated via API. As the identity providers are sub-resources of the login settings, this is done by linking the provider to the settings:

    Activate the Keycloak Provider

    Test the setup​

    To test the setup, use incognito mode and browse to your login page. You see a new button which redirects you to your Keycloak login screen.

    By default, ZITADEL shows what you define in the default settings. If you overwrite the default settings for an organization, you need to send the organization scope in your auth request.

    The organization scope looks like this: urn:zitadel:iam:org:id:{id}. You can read more about the reserved scopes or use the ZITADEL OIDC Playground to see what happens with the login when you send different scopes.

    Keycloak Button

    Keycloak Login