Introduction to single sign-on
Understand how Self-Hosted Deployment uses OpenID Connect for single sign-on, and how just-in-time provisioning creates user accounts.
Read time 1 minuteLast updated 5 days ago
Streamline the management of users in Self-Hosted Deployment with single sign-on (SSO) and just-in-time (JIT) user provisioning.
Self-Hosted Deployment implements SSO through an enterprise identity provider (IdP) using the OpenID Connect (OIDC) protocol. You can use any OIDC-compliant IdP.
Just-in-time provisioning
Keycloak's JIT provisioning mechanism has these automated features:
-
Creates the user account on the first sign-in.You don't need to manually create users. This automated step reduces administrative overhead and enhances the user experience.
-
Populates user attributes.When setting up SSO, you set predefined mappers in Keycloak to automatically populate, on the first sign-in, user attributes from an external IdP or from Keycloak's user store.
The JIT user provisioning process occurs behind the scenes, with a seamless user experience:
- Self-Hosted Deployment redirects, through the OIDC protocol, the new user to their IdP, to sign in.
- The IdP returns the user details to Keycloak.
- Keycloak sends these details to Self-Hosted Deployment in the form of claims.
- Self-Hosted Deployment uses these claims to create the user account on the fly.
Set up SSO
The setup procedure differs, depending on the IdP vendor. The documentation provides guidance for Microsoft, with Entra ID, and for Okta.
In Keycloak, the predefined unity realm stores all the settings and objects that are related to Virtual Private Cloud. When you open the Keycloak admin console, switch to the unity realm.
To set up SSO for Self-Hosted Deployment, complete these tasks:
To maintain security of the solution, regularly Rotate the client secret of the SSO application.