Implement SSO Login Providers in Keycloak (Google, GitLab, GitHub, Facebook) #11

New issue

abed.alrahman · 2025-04-22T23:46:59Z

abed.alrahman commented

2025-04-22 23:46:59 +00:00

Ref epic: #13

Goal: Configure the Keycloak realm to allow users to authenticate using their existing accounts from Google, GitLab, GitHub, and Facebook.

Description:
Keycloak supports SSO login, which means users can log in with their Google account, etc. This ticket will configure Keycloak to support SSO for Google, GitLab, GitHub, and Facebook. This might need to be split into 4 sub-tickets or more since each platform requires setup on its side. For example, to use Google SSO, we need a Google developer account and set up an application on GCP. Each platform will have a different procedure. The ticket will be considered done after the user can log in with their third-party account via the Keycloak login page.

Prerequisites:

Access to the Keycloak Admin Console for the target realm.
Access to developer/admin accounts for Google Cloud Platform, GitLab, GitHub, and Meta for Developers (Facebook).

What needs to be done:

(This ticket can act as a parent tracker. It's recommended to create sub-tickets for each provider due to the distinct setup steps involved.)

For each provider (Google, GitLab, GitHub, Facebook):
    Provider Setup (External):
        Create an OAuth 2.0 application/client within the provider's developer console.
        Configure the application's settings, including the authorized redirect URI provided by Keycloak (e.g., https://<keycloak-host>/realms/<realm>/broker/<provider-alias>/endpoint).
        Obtain the Client ID and Client Secret for the application.
    Keycloak Setup (Internal):
        In the Keycloak Admin Console, navigate to "Identity Providers".
        Add a new provider of the corresponding type (Google, GitLab, GitHub, Facebook).
        Enter the Client ID and Client Secret obtained from the provider.
        Configure necessary scopes (e.g., openid, email, profile).
        Configure Mappers: Set up basic attribute mappers to ensure essential user information (like email, first name, last name) from the external provider is correctly mapped to the Keycloak user profile attributes upon first login. This is crucial for system consistency later.
        Enable the Identity Provider.
Testing:
    Verify that the Keycloak login page now displays login buttons for all configured providers.
    Test the login flow for each provider using a valid external account.
    Confirm that upon successful first login via an external provider, a corresponding user account is created or linked within the Keycloak realm.

Deliverables:

Keycloak realm successfully configured with Google, GitLab, GitHub, and Facebook as enabled Identity Providers.
Functional login flow tested for each provider.
Basic user attribute mapping (email, name) is configured for each provider.

(Sub-tickets recommended: "Configure Google Login in Keycloak", "Configure GitLab Login in Keycloak", etc.)

Ref epic: [#13](https://git.cleverthis.com/clevermicro/user-management/issues/13) Goal: Configure the Keycloak realm to allow users to authenticate using their existing accounts from Google, GitLab, GitHub, and Facebook. Description: Keycloak supports SSO login, which means users can log in with their Google account, etc. This ticket will configure Keycloak to support SSO for Google, GitLab, GitHub, and Facebook. This might need to be split into 4 sub-tickets or more since each platform requires setup on its side. For example, to use Google SSO, we need a Google developer account and set up an application on GCP. Each platform will have a different procedure. The ticket will be considered done after the user can log in with their third-party account via the Keycloak login page. Prerequisites: Access to the Keycloak Admin Console for the target realm. Access to developer/admin accounts for Google Cloud Platform, GitLab, GitHub, and Meta for Developers (Facebook). What needs to be done: (This ticket can act as a parent tracker. It's recommended to create sub-tickets for each provider due to the distinct setup steps involved.) For each provider (Google, GitLab, GitHub, Facebook): Provider Setup (External): Create an OAuth 2.0 application/client within the provider's developer console. Configure the application's settings, including the authorized redirect URI provided by Keycloak (e.g., https://<keycloak-host>/realms/<realm>/broker/<provider-alias>/endpoint). Obtain the Client ID and Client Secret for the application. Keycloak Setup (Internal): In the Keycloak Admin Console, navigate to "Identity Providers". Add a new provider of the corresponding type (Google, GitLab, GitHub, Facebook). Enter the Client ID and Client Secret obtained from the provider. Configure necessary scopes (e.g., openid, email, profile). Configure Mappers: Set up basic attribute mappers to ensure essential user information (like email, first name, last name) from the external provider is correctly mapped to the Keycloak user profile attributes upon first login. This is crucial for system consistency later. Enable the Identity Provider. Testing: Verify that the Keycloak login page now displays login buttons for all configured providers. Test the login flow for each provider using a valid external account. Confirm that upon successful first login via an external provider, a corresponding user account is created or linked within the Keycloak realm. Deliverables: Keycloak realm successfully configured with Google, GitLab, GitHub, and Facebook as enabled Identity Providers. Functional login flow tested for each provider. Basic user attribute mapping (email, name) is configured for each provider. (Sub-tickets recommended: "Configure Google Login in Keycloak", "Configure GitLab Login in Keycloak", etc.)

Rows
Columns