Deploying Keycloak IdP and FusionAuth (OIDC)

This guide will show how to configure Keycloak as an Identity Provider (IdP) with FusionAuth.

Ensure you have administrative access to both your Keycloak and Okta environments. The following high-level milestones will be reached through the course of our deployment.

Configure the FusionAuth client (service provider) within Keycloak.
Configure Keycloak as an Identity Provider within FusionAuth.

Create an OIDC Client in the Keycloak Console

Access the administrative console for your Keycloak environment. It is important to note that within your Keycloak deployment there are Realms. Each Realm will have a unique Federation / OIDC configuration.
Select the Realm of your choice for this integration.
Make a note of the Realm Name setting; in the example it is kevtur. This is a case-sensitive value.
click Clients on the left navigation bar.

Type the name you want for the Client ID, making sure the openid-connect option is selected. Click Save.

Set the Access Type to Confidential.
Scroll down a little and insert the value of the Valid Redirect URI’s to *.

Scroll down a little further and click Save.
Once saved, scroll back to the top of the page and select the Installation tab.

Choose the Format Option of Keycloak OIDC JSON.

The following displays. Save the contents in a text file; the values for auth-server-url, resource, and secret will be used with the FusionAuth configuration.

Under Authentication Flow Overrides select HYPR for both the Browser Flow and Direct Grant Flow options:

Login to the FusionAuth Server to Create the Keycloak IDP Data

Open the FusionAuth Management Console.
Select Settings -> Identity Providers.

In the upper right, click the + sign.

From the popup window select the OpenID Connect option.

Fill in the values from step 10, above, for the Name (resource), Client ID (resource), Client Secret (secret), and the Issuer (auth-connect-url) and change the Button Text to something that you would like to see on the login screen when accessing FusionAuth.

Scroll to the bottom of the form and complete the following:

Set the Scope to email openid profile as three words separated by spaces
Toggle the “FusionAuth” app to on
Click Save in the upper right

Now when you try to login to the FusionAuth Administration Console, you will see the following login screen:

Select OpenID Connect (With HYPR) and you will be sent to the following login page. Type your email address or userID and select Continue.