Document how to configure the Keycloak server and oauth proxy
Closed this issue · 14 comments
Please update the readme to incorporate also the oauth and keycloak configuration.
Belongs to #36
Perfect, thx... waiting for a PR then
@jcte02 Please move this issue to "In Progress" when you start to work and "To Review" when you are done...
@jcte02 Please also accept the invitation to this repository: https://github.com/noi-techpark/it.bz.opendatahub.sparql/invitations
On the Kanban https://github.com/orgs/noi-techpark/projects/19... do you have access?
No I don't have access
Now?
Yes
@jcte02 Hi, it does not work as you describe it. Maybe we miss here some parts?
I get 403 Permission Denied: invalid_request... Do we need Role Mappings for a user? How do I say that only some users can login?
Could you please provide a full description similar as in https://github.com/noi-techpark/authentication-server/blob/master/docs/applications.md?
Since we do not know if left-out fields in the Keycloak configuration will be the default in future versions.
Thx
We use Keycloak v12
@Piiit I used your authentication-server repository to test the authentication before sending the PR. What I wrote in the documentation was all the steps I did on my local Keycloak instance. We clearly have a configuration mismatch here, ie you have configured something in you Keycloak instance I don't know about.
At the moment the authentication is only done on email domain, there is no granularity. If you don't expose or have the email field this can explain the failed authentication. The good news is that everything else is now working, because we are completing the flow with the callback, even if the authentication fails.
Since you mentioned wanting to manage users I would advise switching to group validation. On you Keycloak instance you can have a specific group (eg restricted) whose users will be able to access the restricted endpoint. Managing access then becomes managing that group's membership.
It would help greatly if you could provide me access to a throwaway realm on your testing auth server, or at least provide the relevant configuration, because this is an integration problem and my local configuration always worked.
To save time I will preentivly start working on the group membership. If you can't provide any details about you authentication server I can understand that but I fear it will complicate debugging. If you have access to the logs generated by the authentication proxy it would help greatly.
Regarding documentation, I will rewrite it to include screeshots of the configuration.