SSO With Keycloak

This guide provides step-by-step instructions on how to configure single sign-on (SSO) with Keycloak. You already use Keycloak to conveniently manage permissions to applications. After SSO configuration is complete, you'll also be able to use Keycloak to manage permissions to your Datasources.

Steps

These instructions vary based on your organization's StrongDM region (not your individual location). Follow instructions in the tab for the region of your organization's StrongDM control plane, not your own location. The default control plane region is US.

In your Keycloak admin console, use the realm selector in the upper-left corner to select the realm you want to use for StrongDM. Then go to Clients and click Create client.
On the General settings step, enter the following and then click Next:
1. Name: (Optional) Enter a display name, such as StrongDM.
2. Client ID: Enter a name like StrongDM.
3. Client type: Select OpenID Connect.
On the Capability config step, set the following and then click Next:
1. Authentication flow: Make sure Standard flow is selected. Leave the other flows at their defaults.
2. Client authentication: Turn this On. This makes the client confidential so that Keycloak issues a client secret. (Note that in Keycloak 16 and earlier, this setting was Access Type: confidential.)
On the Login settings step, enter the following and then click Save:
1. Other fields, such as Home URL, Valid post logout redirect URIs, and Web origins, are optional and can be set as you prefer.
2. Valid redirect URIs: https://app.strongdm.com/auth/return
3. Root URL: https://app.strongdm.com
After the client is created, open its Credentials tab. Make sure Client Authenticator is set to Client Id and Secret, and then copy the Client Secret value. You will need this in the next step.
Next, enter the account details in the StrongDM Admin UI. Go to Settings > User Management. In the Single Sign-on section, click the lock icon to make changes, and then set the following:
1. Provider: Select Keycloak.
2. Single sign-on URL: Enter your Keycloak realm URL in the form https://<KEYCLOAK_BASE_URL>/realms/<REALM_NAME> (for example, https://keycloak.example.com/realms/myrealm). Be sure to include the https://.
3. Client ID: Enter the client ID you created in Keycloak.
4. Client Secret: Paste the secret that you copied previously.
Select your desired general SSO settings and click activate.
Verify that all users in StrongDM exist in Keycloak, and that their email addresses match in both systems.

Want to see StrongDM's capabilities beyond SSO with Keycloak? Learn more about how it works or get a demo to see it in action.

In your Keycloak admin console, use the realm selector in the upper-left corner to select the realm you want to use for StrongDM. Then go to Clients and click Create client.
On the General settings step, enter the following and then click Next:
1. Name: (Optional) Enter a display name, such as StrongDM.
2. Client ID: Enter a name like StrongDM.
3. Client type: Select OpenID Connect.
On the Capability config step, set the following and then click Next:
1. Authentication flow: Make sure Standard flow is selected. Leave the other flows at their defaults.
2. Client authentication: Turn this On. This makes the client confidential so that Keycloak issues a client secret. (In Keycloak 16 and earlier, this setting was Access Type: confidential.)
On the Login settings step, enter the following and then click Save:
1. Other fields, such as Home URL, Valid post logout redirect URIs, and Web origins, are optional and can be set as you prefer.
2. Valid redirect URIs: https://app.uk.strongdm.com/auth/return
3. Root URL: https://app.uk.strongdm.com
After the client is created, open its Credentials tab. Make sure Client Authenticator is set to Client Id and Secret, and then copy the Client Secret value. You will need this in the next step.
Next, enter the account details in the StrongDM Admin UI. Go to Settings > User Management. In the Single Sign-on section, click the lock icon to make changes, and then set the following:
1. Provider: Select Keycloak.
2. Single sign-on URL: Enter your Keycloak realm URL in the form https://<KEYCLOAK_BASE_URL>/realms/<REALM_NAME> (for example, https://keycloak.example.com/realms/myrealm). Be sure to include the https://.
3. Client ID: Enter the client ID you created in Keycloak.
4. Client Secret: Paste the secret that you copied previously.
Select your desired general SSO settings and click Save.
Verify that all users in StrongDM exist in Keycloak, and that their email addresses match in both systems.

Want to see StrongDM's capabilities beyond SSO with Keycloak? Learn more about how it works or get a demo to see it in action.

In your Keycloak admin console, use the realm selector in the upper-left corner to select the realm you want to use for StrongDM. Then go to Clients and click Create client.
On the General settings step, enter the following and then click Next:
1. Client type: Select OpenID Connect.
2. Client ID: Enter a name like StrongDM.
3. Name: (Optional) Enter a display name, such as StrongDM.
On the Capability config step, set the following and then click Next:
1. Client authentication: Turn this On. This makes the client confidential so that Keycloak issues a client secret. (Note that in Keycloak 16 and earlier, this setting was Access Type: confidential.)
2. Authentication flow: Make sure Standard flow is selected. Leave the other flows at their defaults.
On the Login settings step, enter the following and then click Save:
1. Root URL: https://app.eu.strongdm.com
2. Valid redirect URIs: https://app.eu.strongdm.com/auth/return
3. Other fields, such as Home URL, Valid post logout redirect URIs, and Web origins, are optional and can be set as you prefer.
After the client is created, open its Credentials tab. Make sure Client Authenticator is set to Client Id and Secret, and then copy the Client Secret value. You will need this in the next step.
Next, enter the account details in the StrongDM Admin UI. Go to Settings > User Management. In the Single Sign-on section, click the lock icon to make changes, and then set the following:
1. Provider: Select Keycloak.
2. Single sign-on URL: Enter your Keycloak realm URL in the form https://<KEYCLOAK_BASE_URL>/realms/<REALM_NAME> (for example, https://keycloak.example.com/realms/myrealm). Be sure to include the https://.
3. Client ID: Enter the client ID you created in Keycloak.
4. Client Secret: Paste the secret that you copied previously.
Select your desired general SSO settings and click Save.
Verify that all users in StrongDM exist in Keycloak, and that their email addresses match in both systems.

Want to see StrongDM's capabilities beyond SSO with Keycloak? Learn more about how it works or get a demo to see it in action.

Configure SSO With Older Keycloak Versions

Keycloak 17 introduced a redesigned admin console and dropped the /auth prefix from its default context path. If you use Keycloak 16 or earlier, or Red Hat Single Sign-On 7.x, or you start Keycloak with the http-relative-path option set to /auth, note the following differences:

Clients are created with Create (not Create client), and the client is configured on a single Settings tab rather than in a multi-step wizard.
Instead of Client authentication: On, set Access Type to confidential.
Your Single sign-on URL in the StrongDM Admin UI includes the /auth prefix: https://<KEYCLOAK_BASE_URL>/auth/realms/<REALM_NAME>.

To confirm the correct value for your deployment, open https://<KEYCLOAK_BASE_URL>/realms/<REALM_NAME>/.well-known/openid-configuration in a browser and use the issuer value it returns. If that URL returns an error, try it with the /auth prefix.

Last updated 7 days ago

Was this helpful?