I’ve managed to make it work, and was able to not only login to my Discourse instance using my Keycloak credentials, but also associate an already-existing Discourse account with the one from OIDC. Unfortunately, I made a mistake when setting up the Keycloak container and I ended up losing its configuration and database.
I’ve since reinstalled Keycloak (properly this time!) and reconfigured Discourse to use the new Client ID, but while it seems that the integration is working (enabling the logs in /logs shows that the authentication actually worked), I can’t seem to associate Discourse accounts with OIDC accounts anymore.
When I try to log into Discourse, I use OIDC, am greeted by the new account UI, and then click the link to associate with an already existing account; I log in, am redirected to Discourse, and if I log out and log in again, I see the same new account UI.
I used the Data Explorer plugin to look at associations, and my user shows up as NULL; the provider ID matches the User ID in Keycloak, though.
I have the “OpenID Connect allow association change” option turned on.
I imagine that Discourse is still hanging onto whatever was there from my previous Keycloak installation, and just changing the new Client ID isn’t doing the trick.
Is there something else I should look into that I may have overlooked?
Are you using the same email address between the accounts? Can you reproduce this issue with a fresh account that wasn’t associated with Keycloak before?
I wasn’t using the same email address between the accounts, but I’ve changed it on Keycloak to match the one used in Discourse, and it’s still the same. The response in Data Explorer is the same (“NULL” user).
I tried creating a new, fresh user, and I’m getting a “Invalid username, email or password” error, even though the username is perfectly fine and available, the email is valid, and the password has been generated by my password manager. This is most likely unrelated but it’s something else I need to figure out why it’s happening.