Single sign-on

Set up single sign-on with OpenID Connect for your private cloud

Read time 1 minute

Last updated a day ago

Overview

Streamline the management of users in Self-Hosted Deployment with single sign-on (SSO) and just-in-time (JIT) user provisioning. Self-Hosted Deployment implements SSO through an enterprise identity provider (IdP) using the OpenID Connect (OIDC) protocol. You can use any OIDC-compliant IdP.

Just-in-time provisioning

Keycloak's JIT provisioning mechanism provides these automated features:

Creation of the user account on the first sign-in. You don't need to manually create users. This automated step reduces administrative overhead and enhances the user experience.
Population of user attributes. When setting up SSO, you set predefined mappers in Keycloak to automatically populate, on the first sign-in, user attributes from an external IdP or from Keycloak's user store.

The JIT user provisioning process occurs behind the scenes, with a seamless user experience:

Self-Hosted Deployment redirects, through the OIDC protocol, the new user to their IdP, to sign in.
The IdP returns the user details to Keycloak.
Keycloak sends these details to Self-Hosted Deployment in the form of claims.
Self-Hosted Deployment uses these claims to create the user account on the fly.

Setup

The setup procedure differs, depending on the IdP vendor. This section provides guidance for Microsoft, with Entra ID, and for Okta. In Keycloak, the predefined unity realm stores all the settings and objects that are related to Virtual Private Cloud. When you open the Keycloak admin console, switch to the unity realm. To set up SSO for Self-Hosted Deployment, complete these tasks:

1. Integrate with the identity service provider

2. Configure the user experience for SSO

To maintain security of the solution perform these tasks regularly:

1. Rotate the client secret of the SSO application

Documentation

Development

User Acquisition

Monetization

Industry