Skip to main content

Create clients in Keycloak for OIDC in StorageGRID

Contributors netapp-pcarriga
PDFs

Use Keycloak to create a client connection for each Admin Node for OpenID Connect (OIDC) in your StorageGRID system.

Before you begin

  • You have experience creating clients in Keycloak, or you have access to the Keycloak documentation.

  • You have a dedicated account (Bind DN) for directory lookups and the login credentials.

  • You have Keycloak Administrator access.

About this task

Each Admin Node in your StorageGRID system must have a client connection. This ensures that users can securely sign in to and out of any Admin Node. You can create a single client connection for all Admin Nodes (recommended) or a different client connection for each Admin Node.

Use the default settings unless otherwise specified. In some cases you can use settings required by your organization.

Step 1: Optionally, create a realm

Create a Keycloak realm to configure the LDAP provider and OIDC client, or use the Keycloak default realm.

Steps

  1. Select Create Realm.

  2. Enter a name for the realm.

  3. Select Enabled.

  4. Select Create.

Step 2: Configure LDAP provider

Configure the LDAP provider so that Keycloak connects to the Active Directory Federation Service (AD FS) LDAP server.

Steps

  1. Select User federation > Add Ldap providers.

  2. Under the Settings tab:

    1. Enter the following recommended values:

      • UI display name: Enter a unique value.

      • Vendor: Active Directory

      • Connection URL: ldap://<ldap_IP_address> or ldaps://<ldap_IP_address>

      • Connection pooling: ON

      • Bind DN: Enter your Bind DN

      • Bind credentials: Enter password

      • Edit mode: READ_ONLY

      • Users DN: For example, CN=Users, DC=saml, DC=sgws

      • Username LDAP attribute: sAMAccountName

      • RDN LDAP attribute: cn

      • UUID LDAP attribute: objectGUID

      • User object classes: person, organizationalPerson, user

      • User LDAP filter: (sAMAccountName=*)

      • Search scope: Subtree

      • Pagination: ON

      • Import users: ON

      • Sync registrations: ON

      • Remove invalid users during searches: ON

    2. Select Test connection and Test authentication.

      Resolve any issues that might occur before continuing.

  3. Select Save.

Step 3: Configure LDAP mapping

Configure LDAP mapping to map AD as an attribute to Keycloak.

Steps

  1. Go to User federation > LDAP

  2. Select the LDAP provider you created.

  3. On the Mappers tab, select Add mapper > Create new mapper.

  4. For Mapper Type, select user-attribute-ldap-mapper.

  5. Select Save, then enter the following information:

    • User Model Attribute: userPrincipalName

    • LDAP Attribute: userPrincipalName

    • Read Only: ON

    • Always Read Value From LDAP: ON

    • Is mandatory in LDAP: OFF

    • Force a Default value: ON

    • Is Binary Attribute: OFF

  6. Select Save.

Step 4: Create OIDC client

Create the OIDC client for your system.

Steps

  1. Go to Clients > Create client.

  2. For General settings, enter the following information:

    • Name: Enter a display name for the client.

    • Client type: OIDC Connect

    • Client ID: Enter a unique value. Save this value for use later.

  3. Select Next.

  4. For Capability config, enter the following information:

    • Client authentication: ON

    • Standard flow: Enable

    • Direct access grants: Enable

    • Service account roles: Enable

  5. Select Next.

  6. For Login settings, enter the redirect URIs:

    Note If one or more load balancer endpoints are configured for the management interface, add the redirect URIs for each port. For example: https://<Admin_IP_address_or_FQDN>:<port>/api/v4/oidc-callback and https://<Admin_IP_address_or_FQDN>:<port>/api/v4/oidc-logged-out

    • Valid redirect URIs: https://<Admin_IP_address_or_FQDN>/api/v4/oidc-callback and https://<Admin_IP_address_or_FQDN>/api/v4/oidc-logged-out

    • Valid post logout redirect URIs: https://<Admin_IP_address_or_FQDN>/api/v4/oidc-logged-out

    • Web origins: https://<Admin_IP_address_or_FQDN>

  7. Select Save.

Step 5: Generate client secret

Generate a client secret for the OIDC client you created.

Steps

  1. Go to Clients, then select the OIDC client you created.

  2. On the Credentials tab, enter the following information:

    • Client authenticator: Client Id and Secret

    • Client secret: Generate or set a client secret. Save this value for use later.

Step 6: Define scopes

Define the scopes in Keycloak.

Steps

  1. Go to Client scopes > Create client scope, then enter the following information:

    • Type: None

    • Protocol: OpenID Connect

    • Display on consent screen: Enabled

    • Include in OpenID Provider Metadata: Enabled

  2. Select Save.

  3. On the Mappers tab, select Configure a new mapper > User Attribute, then enter the following information:

    • Name: Enter a unique value.

    • User Attribute: userPrincipalName

    • Token Claim Name: upn

    • Claim JSON Type: String

    • Add to ID token: ON

    • Add to access token: ON

    • Add to userinfo: ON

    • Add to token introspection: ON

  4. Select Save.

  5. Go to Clients and select the OIDC client you created.

  6. Select Client Scopes > Add client scope.

  7. Select the client scope you created.

  8. Select Add.

Step 7: Prepare to configure SSO using OIDC

Save the information required to configure SSO with OIDC using Keycloak in your StorageGRID system.

Steps

  1. Check that you've saved the client ID and the client secret from the OIDC client you created.

  2. Save the OpenID Connect discovery endpoint for the realm. This is available in the well-known configuration endpoint:

    https://<keycloak_host_ip/keycloak_host_name>/realms/<realm_name>/.well-known/openid-configuration

    Optionally include the network port:

    https://<keycloak_host_ip/keycloak_host_name>:<https_port>/realms/<realm_name>/.well-known/openid-configuration

What's next

After creating OIDC clients, configure SSO using OIDC.