Is there a way to setup Keycloak as auth provider for Discourse? I need this to work in SSO manner, so that my users that have created account managed by Keycloak automatically have access and are logged in into Discourse instance too. I have read about OpenID configuration and people say that users have to login separately and create a separate account in Discourse with this setup. It’s not exactly what I am after. Anything I could/should read about the topic? My intention is to have Discourse and Keycloak to be setup in separate composed docker containers and I would need a seamless auth between them so that I could create posts in Discourse using my API backend on behalf of the user that is logged in in my JS frontened app, with user data managed by Keycloak.

Easiest solution I have done for users with keycloak as their enterprise IAM is to set up discourse saml https://github.com/discourse/discourse-saml configuring keycloak saml is fairly straightforward SAML - Server Administration Guide SAML 2.0 is a similar specification to OIDC but more mature. It is descended from SOAP and web service messaging specifications so is generally more verbose than OIDC. SAML 2.0 is an authentication protocol that exchanges XML documents between... Alernatively, you can connect via openID connect as well https://github.com/discourse/discourse-openid-connect To let users automatically login with SAML, you’ll have to disable all other authentication methods including local login. make sure that your admin account already has a corresponding account on keycloak or you’ll be locked out of admin.

Interesting, thanks. Disabling all other means of login is not really an option. I want to keep using my Keycloak as the main mean of auth in my app, but, additionally, allow users to be in Discourse. That would mean that my users need to be able to register with login/password or any social network they want and just get and account that would work for both my app and Discourse. Is something like that possible? PS. Just reading it through again, do you mean disable auth methods on Keycloak or in Discourse?

Social Auth or username/password would have to be done via keycloak. Plus I just realized that it doesn’t automatically log in users. what it would do is to let users directly authenticate against keycloak if they click on the login button.

So let’s say that I at first want to access everything via API. Will I still be able to? Login is Discourse UI part. Let’s say a new user registers on my Keycloak server and I have this SAML integration. User is logged in in my JS web-app and I have his token. Will I be able to somehow call Discourse API using just this token? That is if I want to have a custom UI creating Posts from my web-app.

[image] AAverin: So let’s say that I at first want to access everything via API. Will I still be able to? You can access all the api endpoints using API keys as far as I know. [image] AAverin: Will I be able to somehow call Discourse API using just this token? You should be able to, nothing is stopping you from doing that.

Discourse with Keycloak for SSO

Development

mahcr (Mariano Alvarez) January 23, 2021, 8:30am 7

@AAverin did you find a solution?

Topic		Replies	Views
Intergrate Discourse with keycloak SSO	15	5065	November 9, 2024
Keycloak with Discourse SSO	19	9301	January 23, 2021
Discourse, Keycloak, SAML vs OAuth Product Support	3	2010	September 24, 2020
Discourse, Keycloak, SAML - is it impossible to configure? SSO	7	5081	March 16, 2021
Discourse-saml, choosing solution Product Support	13	2260	December 18, 2019

Discourse with Keycloak for SSO

Related topics