Keystone with OpenID Connect

Configure an external Keycloak to provide authentication for Keystone
The objective is to identify a user and allow them to find their projects in Openstack.

Keycloak client configuration

This guide assumes you already have a working Keycloak server.
What is covered here is how to :

• create a client in Keycloak for Keystone
• configure this client

Client creation and settings

• Got to your Keycloak admin console and configure a new client (click Create)

Keycloak admin console

• Let's assume your client is named Keystone
  • Leave Root URL empty
  • Select openid-connect for Client Protocol
  • Select confidential for Access Type
  • Standard Flow Enabled, Implicit Flow Enabled and Direct Access Grants Enabled must be on
  • The *fqdn* for Valid Redirect URIs should match the value of kolla_external_fqdn. If your kolla_internal_fqdn is par1.cloud.ld, then your Valid Redirect URIs should be https://par1.cloud.ld:5000/redirect_uri. You can also add the URI of your Horizon dashboard

Keycloak client settings

• Don't forget to copy the client's key (via Credentials tab)

Client mappers

Add the following mappers to the new client :

• groups via Add Builtin button and type Group Membership
• email via Add Builtin button and type User Property
• username via Add Builtin button and type User Property

Keycloak client mappers