Requirement:
Keycloak
Portainer
Steps to follow:
Keycloak
- Log in to the Keycloak console as an admin.
- Navigate to the realm if one has already been created for Portainer; otherwise, create a new realm for the SSO client.
Go to the new realm -> client -> new -> OpenID Connect -> fill in the details and click next.
Enable client authentication and OAuth 2.0 -> Click next
fill the URL based on your portainer URL and click save
Now get into the newly created client -> credentials -> copy the client secret and store it somewhere
Now create a user in the realm ( portainer ) -> user -> add user and create a user
Portainer
Login to the portainer -> go to settings -> Authentication
- enable OAuth by selecting OAuth and enabling the ‘Use SSO’ option.
- Scroll down and add the provider details
fill in the below details based on your configuration:
- Client ID : portainer
- Client secret: “client secret which we copied from keycloak”
- Authorization URL: https://{keycloak url}/realms/{realm created for porainer}/protocol/openid-connect/auth
- Access token URL: https://{keycloak url}/realms/{realm created for porainer}/protocol/openid-connect/token
- Resource URL: https://{keycloak url}/realms/{realm created for porainer}/protocol/openid-connect/userinfo
- Redirect URL: https://portainer.example.com/
- Logout URL: https://{keycloak url}/realms/{realm created for porainer}/protocol/openid-connect/logout
- User identifier: email
- Scopes: openid
Now logout and login again to Portainer. You will see the “Login with OAuth” option displayed -> click on that and use the username and password created from Keycloak.
