Skip to main content
Version: v2.9

Configure Keycloak (OIDC)

If your organization uses Keycloak Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials. Rancher supports integration with Keycloak using the OpenID Connect (OIDC) protocol and the SAML protocol. Both implementations are functionally equivalent when used with Rancher. This page describes the process to configure Rancher to work with Keycloak using the OIDC protocol.

If you prefer to use Keycloak with the SAML protocol instead, refer to this page.

If you have an existing configuration using the SAML protocol and want to switch to the OIDC protocol, refer to this section.

Prerequisites

  • On Rancher, Keycloak (SAML) is disabled.

  • You must have a Keycloak IdP Server configured.

  • In Keycloak, create a new OIDC client, with the settings below. See the Keycloak documentation for help.

    SettingValue
    Client ID<CLIENT_ID> (e.g. rancher)
    Name<CLIENT_NAME> (e.g. rancher)
    Client Protocolopenid-connect
    Access Typeconfidential
    Valid Redirect URIhttps://yourRancherHostURL/verify-auth
  • In the new OIDC client, create Mappers to expose the users fields.

    • Create a new "Groups Mapper" with the settings below.

      SettingValue
      NameGroups Mapper
      Mapper TypeGroup Membership
      Token Claim Namegroups
      Full group pathOFF
      Add to ID tokenOFF
      Add to access tokenOFF
      Add to user infoON
    • Create a new "Client Audience" with the settings below.

      SettingValue
      NameClient Audience
      Mapper TypeAudience
      Included Client Audience<CLIENT_NAME>
      Add to ID tokenOFF
      Add to access tokenON
    • Create a new "Groups Path" with the settings below.

      SettingValue
      NameGroup Path
      Mapper TypeGroup Membership
      Token Claim Namefull_group_path
      Full group pathON
      Add to ID tokenON
      Add to access tokenON
      Add to user infoON
  • Go to Role Mappings > Client Roles > realm-management and add the following Role Mappings to all users or groups that need to query the Keycloak users.

    • query-users
    • query-groups
    • view-users

Configuring Keycloak in Rancher

  1. In the Rancher UI, click ☰ > Users & Authentication.

  2. In the left navigation bar, click Auth Provider.

  3. Select Keycloak (OIDC).

  4. Complete the Configure a Keycloak OIDC account form. For help with filling the form, see the configuration reference.

  5. After you complete the Configure a Keycloak OIDC account form, click Enable.

    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Keycloak IdP to validate your Rancher Keycloak configuration.

    note

    You may need to disable your popup blocker to see the IdP login page.

Result: Rancher is configured to work with Keycloak using the OIDC protocol. Your users can now sign into Rancher using their Keycloak logins.

Configuration Reference

FieldDescription
Client IDThe Client ID of your Keycloak client.
Client SecretThe generated Secret of your Keycloak client. In the Keycloak console, select Clients, select the client you created, select the Credentials tab and copy the value of the Secret field.
Private Key / CertificateA key/certificate pair to create a secure shell between Rancher and your IdP. Required if HTTPS/SSL is enabled on your Keycloak server.
EndpointsChoose whether to use the generated values for the Rancher URL, Issue, and Auth Endpoint fields or to provide manual overrides if incorrect.
Keycloak URLThe URL for your Keycloak server.
Keycloak RealmThe name of the realm in which the Keycloak client was created in.
Rancher URLThe URL for your Rancher Server.
IssuerThe URL of your IdP.
Auth EndpointThe URL where users are redirected to authenticate.

Migrating from SAML to OIDC

This section describes the process to transition from using Rancher with Keycloak (SAML) to Keycloak (OIDC).

Reconfigure Keycloak

  1. Change the existing client to use the OIDC protocol. In the Keycloak console, select Clients, select the SAML client to migrate, select the Settings tab, change Client Protocol from saml to openid-connect, and click Save

  2. Verify the Valid Redirect URIs are still valid.

  3. Select the Mappers tab and create a new Mapper with the settings below.

    SettingValue
    NameGroups Mapper
    Mapper TypeGroup Membership
    Token Claim Namegroups
    Add to ID tokenON
    Add to access tokenON
    Add to user infoON

Reconfigure Rancher

Before configuring Rancher to use Keycloak (OIDC), Keycloak (SAML) must be first disabled.

  1. In the Rancher UI, click ☰ > Users & Authentication.
  2. In the left navigation bar, click Auth Provider.
  3. Select Keycloak (SAML).
  4. Click Disable.

Configure Rancher to use Keycloak (OIDC) by following the steps in this section.

note

After configuration is completed, Rancher user permissions will need to be reapplied as they are not automatically migrated.

Annex: Troubleshooting

If you are experiencing issues while testing the connection to the Keycloak server, first double-check the configuration options of your OIDC client. You may also inspect the Rancher logs to help pinpoint what's causing issues. Debug logs may contain more detailed information about the error. Please refer to How can I enable debug logging in this documentation.

All Keycloak related log entries will be prepended with either [generic oidc] or [keycloak oidc].

You are not redirected to Keycloak

When you fill the Configure a Keycloak OIDC account form and click on Enable, you are not redirected to your IdP.

  • Verify your Keycloak client configuration.

The generated Issuer and Auth Endpoint are incorrect

  • On the Configure a Keycloak OIDC account form, change Endpoints to Specify (advanced) and override the Issuer and Auth Endpoint values. To find the values, go to the Keycloak console and select Realm Settings, select the General tab, and click OpenID Endpoint Configuration. The JSON output will display values for issuer and authorization_endpoint.

Keycloak Error: "Invalid grant_type"

  • In some cases, this error message may be misleading and is actually caused by setting the Valid Redirect URI incorrectly.