# Keycloak with Discourse
**URL:** https://meta.discourse.org/t/keycloak-with-discourse/63139
**Category:** SSO
**Created:** [22 Mayo, 2017 13:50 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139 "2017-05-22T13:50:41Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@maisa](https://meta.discourse.org/u/maisa)
#### Post date: [22 Mayo, 2017 13:50 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/1 "2017-05-22T13:50:41Z")
Hi everyone,
I’m new with Discourse and I’m trying to use it with Keycloak. But I’m not being able to set keycloak as SSO to Discourse.
What I need is: the user is authenticated on my site, through keycloak, and when try to access my Discourse instance he already be authenticated.
Could someone help me ?
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [22 Mayo, 2017 18:35 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/2 "2017-05-22T18:35:35Z")
Could you provide some more info about your setup please? Did you follow the sso guide? What settings did you add to keycloak? Are requests making it to Discourse?
---
### Author:  [@maisa](https://meta.discourse.org/u/maisa)
#### Post date: [22 Mayo, 2017 19:35 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/3 "2017-05-22T19:35:16Z")
I tried to follow the sso guide, but I got confused.
On Discouse I configured the OAuth2 plugin and my sso configuration is:
enable sso: is checked
sso url: [http://mykeycloakdomain/auth/realms/myrealm/protocol/openid-connect/auth?response\_type=code&scope=openid&client\_id=myclientid&redirect\_uri=http//mydiscoursedomain/session/sso\_login](http://mykeycloakdomain/auth/realms/myrealm/protocol/openid-connect/auth?response_type=code&scope=openid&client_id=myclientid&redirect_uri=http//mydiscoursedomain/session/sso_login)
sso secret: this\_is\_my\_secret
On Keycloak I just put this url ([http://mydiscoursedomain/session/sso\_login](http://mydiscoursedomain/session/sso_login)) on my client Valid Redirect URIs field.
When I login on Keycloak and it try to rediret to [http://mydiscoursedomain/session/sso\_login](http://mydiscoursedomain/session/sso_login), the url redirect is [http://mydiscoursedomain/session/sso\_login?code=somecode](http://mydiscoursedomain/session/sso_login?code=somecode) and it gives me HTTP ERROR 500
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [22 Mayo, 2017 19:52 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/4 "2017-05-22T19:52:58Z")
OAuth2 plugin is an auth strategy (like Facebook, Twitter, etc) while SSO is another thing.
You want one or another. You can’t use both.
---
### Author:  [@maisa](https://meta.discourse.org/u/maisa)
#### Post date: [22 Mayo, 2017 20:01 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/5 "2017-05-22T20:01:47Z")
I disable OAuth2 plugin, even so when Keycloak redirect to [http://mydiscoursedomain/session/sso\_login](http://mydiscoursedomain/session/sso_login) I get an erro 500 and the url came as [http://mydiscoursedomain/session/sso\_login?code=qEv3eXual\_dkdMteGxeouUu0ih8Q8IGfSg-O\_\_nMYgg.eac438e7-886d-459e-830e-857ef244a0ed](http://mydiscoursedomain/session/sso_login?code=qEv3eXual_dkdMteGxeouUu0ih8Q8IGfSg-O__nMYgg.eac438e7-886d-459e-830e-857ef244a0ed)
Keycloak did not return the params sso=payload and sig=sig as expected for Discourse.
This maybe has something to do with sso version ? Or do I need to configure something else on Keycloak ?
My Keycloak instance version is 3.1.0.Final
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [22 Mayo, 2017 20:41 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/6 "2017-05-22T20:41:23Z")
There is a post where a user managed to get [KeyCloak and the OAuth2 plugin to work together](https://meta.discourse.org/t/oauth2-basic-support/33879/56)
But this is not [Discourse SSO](https://meta.discourse.org/t/13045?silent=true), you should disable SSO and use only the OAuth2 plugin in this case.
---
### Author:  [@maisa](https://meta.discourse.org/u/maisa)
#### Post date: [22 Mayo, 2017 20:50 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/7 "2017-05-22T20:50:34Z")
Actually I was able to make OAuth2 work with Keycloak. But when I do this even if the user is authenticated on my site, when they go to my Discourse instance he needs to click on “Log in” button to get access to the information on the forum.
That is why I was tring to make SSO work with Keycloak, doing so I espect that if the user is already authenticated on my site he was able to access my Discourse instance without need to log in or click on “log in” button on Discourse home.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [22 Mayo, 2017 20:52 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/8 "2017-05-22T20:52:13Z")
Actually, you can get this behavior on both OAuth2 and SSO, by checking the `login_required` setting.
However, this will prevent anonymous reading and search engines from listing your site.
---
### Author:  [@maisa](https://meta.discourse.org/u/maisa)
#### Post date: [22 Mayo, 2017 21:17 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/9 "2017-05-22T21:17:27Z")
So I’m missing some configuration, because if I enable the OAuth2 with Keycloak, authenticate myself on Keycloak and an another tab try to access my Discourse intance I’m redirect to Discourse login page and need to click on “Log In” (blue button) to Discourse verify with Keycloak that I’m already authenticated.
I really don’t want that anonymous users be able to read my Discourse instance.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [22 Mayo, 2017 21:22 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/10 "2017-05-22T21:22:59Z")
> [@maisa](#):
>
> I really don’t want that anonymous users be able to read my Discourse instance.
Did you check the `login_required` setting on Discourse?
---
### Author:  [@maisa](https://meta.discourse.org/u/maisa)
#### Post date: [23 Mayo, 2017 11:07 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/11 "2017-05-23T11:07:49Z")
Yes, but is still necessary to click on “Log in” button to access Discourse, even I’m already authenticated on my site.
There is no way to be authenticated on my site and when I access my Discourse instance I accesses it without the need to click on “Log in” button ?
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [23 Mayo, 2017 11:34 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/12 "2017-05-23T11:34:11Z")
> [@maisa](#):
>
> There is no way to be authenticated on my site and when I access my Discourse instance I accesses it without the need to click on “Log in” button ?
I’m not familiar with Keycloak or this specific OAuth integration but this seems relevant to you - but depends on the solution you end up choosing SSO / OAuth etc:
> [@SSO integration & external profile sync help](https://meta.discourse.org/t/sso-integration-external-profile-sync-help/62457/4):
>
> just have your page contain insert a hidden IFRAME / EMBED of the Discourse site to the URL `/session/sso`…
> Only add this hidden IFRAME when the user hasn’t been authenticated recently (so it doesn’t slow down every page load) - probably just when they initially login.
>
> This will keep the Discourse session alive. This will also log them into Discourse if they aren’t already
>
> You can look to the Discourse WordPress plugin I believe it contains something like this.
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [23 Mayo, 2017 11:37 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/13 "2017-05-23T11:37:10Z")
Note that the `iframe` won’t work if Discourse is running on an unrelated domain, as browsers will consider these cookies to be third-party cookies 🍪
An alternative is to make sure that all links to the forum point to `/session/sso` while the user is authenticated in the parent site.
---
### Author:  [@maisa](https://meta.discourse.org/u/maisa)
#### Post date: [23 Mayo, 2017 17:10 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/14 "2017-05-23T17:10:51Z")
@DeanMarkTaylor and @fefrei, thank you for the answer.
But I’m not being able to configure [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) to work with Keycloak.
Keycloak works with SAML, OpenID and OAuth protocols.
On my SSO configuration is:
enable sso: is checked
sso url: [http://mykeycloakdomain/auth/realms/myrealm/protocol/openid-connect/auth?response\_type=code&scope=openid&client\_id=myclientid&redirect\_uri=http//mydiscoursedomain/session/sso\_login](http://mykeycloakdomain/auth/realms/myrealm/protocol/openid-connect/auth?response_type=code&scope=openid&client_id=myclientid&redirect_uri=http//mydiscoursedomain/session/sso_login)
sso secret: this\_is\_my\_secret
Where on sso url I put the redirect\_uri to redirect to Discourse session/sso\_login. But when Keycloak do the redirect it did not passes the param sso and sin on url as expected for Discourse, so I get an error 500. So I don’t know if I’m missing some configuration or if not able to integrate Keycloak with Discourse by sso.
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [23 Mayo, 2017 17:19 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/15 "2017-05-23T17:19:18Z")
Discourse uses its own SSO protocol. If there is no Keycloak plugin that supports this yet and you don’t want to build one, you’ll have to use another authentication scheme. I’d suspect then OAuth is easiest because there already is a [Discourse plugin](https://meta.discourse.org/t/oauth2-basic-support/33879) for it 🙂
---
### Author:  [@maisa](https://meta.discourse.org/u/maisa)
#### Post date: [23 Mayo, 2017 18:38 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/16 "2017-05-23T18:38:22Z")
Hum, it explains a lot. 🙂
OAuth plugin works just fine with Keycloak, the only thing is that the user needs to click on “Log in” button when he goes from my site to my instance of Discourse. But I’ll try to find a way to do it without the user knowing or find some plugin to work with OpenID.
Thank you, very much.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [23 Mayo, 2017 18:45 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/17 "2017-05-23T18:45:15Z")
Ok, this is the last time I’m repeating this.
> [@maisa](#):
>
> the only thing is that the user needs to click on “Log in” button when he goes from my site to my instance of Discourse
If you have `login_required` set to true **AND** OAuth2 is the only login strategy (disable local\_logins and social logins), the user should be prompted to login **without** clicking on the button. Many people use this, and it works fine.
---
### Author:  [@maisa](https://meta.discourse.org/u/maisa)
#### Post date: [23 Mayo, 2017 20:18 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/18 "2017-05-23T20:18:58Z")
I saw what you said, but as a said before I really don’t know wich configuration I’m missing.
Here is my configuration, I checked the option login\_required (true) and only option I checked was auth2 enabled (true) and still I get on login page from Discouse. Could you help me ?
   
---
### Author:  [@GGGforce](https://meta.discourse.org/u/GGGforce)
#### Post date: [23 Octubre, 2020 20:54 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/19 "2020-10-23T20:54:04Z")
@maisa, ¿lograste alguna vez alcanzar tu objetivo? Estoy intentando hacer lo mismo. Si un usuario ya ha iniciado sesión en mi cuenta de Keycloak y visita mi Discourse, quiero que el usuario ya haya iniciado sesión sin tener que hacer nada.
Por cierto, ¿tuviste que programar tu propio endpoint JSON de información de usuario para convertir el token a JSON, o yo también?
---
### Author:  [@mahcr](https://meta.discourse.org/u/mahcr)
#### Post date: [23 Enero, 2021 07:30 UTC](https://meta.discourse.org/t/keycloak-with-discourse/63139/20 "2021-01-23T07:30:05Z")
¿Alguien encontró una solución? He estado intentando configurar SSO con Keycloak, pero sin éxito.