# Discourse with Keycloak for SSO
**URL:** https://meta.discourse.org/t/discourse-with-keycloak-for-sso/152922
**Category:** Development
**Created:** [May 27, 2020, 8:59am UTC](https://meta.discourse.org/t/discourse-with-keycloak-for-sso/152922 "2020-05-27T08:59:35Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@AAverin](https://meta.discourse.org/u/AAverin)
#### Post date: [May 27, 2020, 8:59am UTC](https://meta.discourse.org/t/discourse-with-keycloak-for-sso/152922/1 "2020-05-27T08:59:35Z")
Is there a way to setup Keycloak as auth provider for Discourse? I need this to work in SSO manner, so that my users that have created account managed by Keycloak automatically have access and are logged in into Discourse instance too.
I have read about OpenID configuration and people say that users have to login separately and create a separate account in Discourse with this setup. It’s not exactly what I am after.
Anything I could/should read about the topic?
My intention is to have Discourse and Keycloak to be setup in separate composed docker containers and I would need a seamless auth between them so that I could create posts in Discourse using my API backend on behalf of the user that is logged in in my JS frontened app, with user data managed by Keycloak.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [May 27, 2020, 9:10am UTC](https://meta.discourse.org/t/discourse-with-keycloak-for-sso/152922/2 "2020-05-27T09:10:33Z")
Easiest solution I have done for users with keycloak as their enterprise IAM is to set up discourse saml
[https://github.com/discourse/discourse-saml](https://github.com/discourse/discourse-saml)
configuring keycloak saml is fairly straightforward
> **[SAML - Server Administration Guide](https://www.keycloak.org/docs/latest/server_admin/index.html#_saml)**
>
> SAML 2.0 is a similar specification to OIDC but more mature. It is descended from SOAP and web service messaging specifications so is generally more verbose than OIDC. SAML 2.0 is an authentication protocol that exchanges XML documents between...
Alernatively, you can connect via openID connect as well
[https://github.com/discourse/discourse-openid-connect](https://github.com/discourse/discourse-openid-connect)
~~To let users automatically login with SAML, you’ll have to disable all other authentication methods including local login. make sure that your admin account already has a corresponding account on keycloak or you’ll be locked out of admin.~~
---
### Author:  [@AAverin](https://meta.discourse.org/u/AAverin)
#### Post date: [May 27, 2020, 9:20am UTC](https://meta.discourse.org/t/discourse-with-keycloak-for-sso/152922/3 "2020-05-27T09:20:29Z")
Interesting, thanks.
Disabling all other means of login is not really an option. I want to keep using my Keycloak as the main mean of auth in my app, but, additionally, allow users to be in Discourse.
That would mean that my users need to be able to register with login/password or any social network they want and just get and account that would work for both my app and Discourse.
Is something like that possible?
PS. Just reading it through again, do you mean disable auth methods on Keycloak or in Discourse?
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [May 27, 2020, 9:21am UTC](https://meta.discourse.org/t/discourse-with-keycloak-for-sso/152922/4 "2020-05-27T09:21:57Z")
Social Auth or username/password would have to be done via keycloak. Plus I just realized that it doesn’t automatically log in users. what it would do is to let users directly authenticate against keycloak if they click on the login button.
---
### Author:  [@AAverin](https://meta.discourse.org/u/AAverin)
#### Post date: [May 27, 2020, 9:24am UTC](https://meta.discourse.org/t/discourse-with-keycloak-for-sso/152922/5 "2020-05-27T09:24:54Z")
So let’s say that I at first want to access everything via API. Will I still be able to?
Login is Discourse UI part.
Let’s say a new user registers on my Keycloak server and I have this SAML integration. User is logged in in my JS web-app and I have his token. Will I be able to somehow call Discourse API using just this token?
That is if I want to have a custom UI creating Posts from my web-app.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [May 27, 2020, 9:26am UTC](https://meta.discourse.org/t/discourse-with-keycloak-for-sso/152922/6 "2020-05-27T09:26:59Z")
> [@AAverin](#):
>
> So let’s say that I at first want to access everything via API. Will I still be able to?
You can access all the api endpoints using API keys as far as I know.
> [@AAverin](#):
>
> Will I be able to somehow call Discourse API using just this token?
You should be able to, nothing is stopping you from doing that.
---
### Author:  [@mahcr](https://meta.discourse.org/u/mahcr)
#### Post date: [January 23, 2021, 8:30am UTC](https://meta.discourse.org/t/discourse-with-keycloak-for-sso/152922/7 "2021-01-23T08:30:42Z")
@AAverin did you find a solution?
---
### Author:  [@Ndacyayisenga-droid](https://meta.discourse.org/u/Ndacyayisenga-droid)
#### Post date: [March 10, 2022, 9:36pm UTC](https://meta.discourse.org/t/discourse-with-keycloak-for-sso/152922/8 "2022-03-10T21:36:58Z")
@AAverin did you go over this