Keycloak

sysman sysadmin

With the Keycloak provider, users sign in to Allegra with their accounts from a Keycloak server. The login page shows the button Continue with Keycloak.

In your Keycloak realm, create an OpenID Connect client with client authentication enabled and register the callback URL shown in the provider form as a valid redirect URI (see Callback URL).

In Allegra, go to Administration > Users & Groups > Authentication > OpenID providers and add the provider Keycloak. The configuration form is described in OpenID Providers; for Keycloak, note:

• Issuer URL — the Keycloak realm URL, e.g. https://keycloak.example.com/realms/myrealm. All endpoints are discovered from it.

• Client ID and Client secret — from the client you created in the realm.

For user matching, Keycloak reports the email claim; see User matching and auto-registration. Signing out of Allegra also signs the user out of Keycloak.