Setting Up the Keycloak Client

This is the second of three setup stages. Configure the Keycloak provider before proceeding.

Notation

The SA Web base address depends on the publishing scheme:

Token	Description	Direct publishing	Behind a proxy
<OSD_BASE>	SA Web base address	https://<OSD_HOST>:5601	https://<OSD_HOST>

The remaining tokens do not depend on the publishing scheme:

Token	Description
<OSD_HOST>	external hostname of the SA Web machine
<CLIENT_ID>	technical client name, unique per host
<CLIENT_SECRET>	client secret, the Credentials tab

Add a Client

Go to Clients - Create client.

Screen 1. General Parameters

Select OpenID Connect in Client type and enter <CLIENT_ID> in Client ID.

Screen 2. Capability config

Field	Value	Purpose
Client authentication	On	the client secret appears
Standard flow	selected	authorization code flow
Direct access grants	clear	otherwise a token can be obtained with a username and password through the API, bypassing the second factor
Implicit flow	clear	deprecated
Service accounts roles	clear	not required

Screen 3. Login Settings

Field	Value
Root URL	<OSD_BASE>
Home URL	<OSD_BASE>
Valid redirect URIs	<OSD_BASE>/auth/openid/login
Valid post logout redirect URIs	<OSD_BASE>/*
Web origins	<OSD_BASE>

The Valid redirect URIs value is used for sign-in. An asterisk is allowed only in Valid post logout redirect URIs; Keycloak matches the Valid redirect URIs value character by character.

The client secret <CLIENT_SECRET> is in the Client secret field on the Credentials tab.

Groups in the Token

Go to Clients - <CLIENT_ID> - Client scopes - <CLIENT_ID>-dedicated - Add mapper - By configuration - Group Membership and set the values:

Field	Value
Token Claim Name	groups
Full group path	Off
Add to ID token	On

Note!

Create the mapper separately for each client. It is required to map the group correctly to a backend_role in SA Data Storage.

Next: Setting Up Search Anywhere Framework.