Oauth2 Authentication using Keycloak
It is necessary:
To have an authentication server with OAUTH2 protocol, for example, Keycloak;
To connect to the authentication server;
After reading a new user, the system will attribute permissions based on the following parameters:
- Access the main navigation Menu > Parametrization > Authentication > Oauth2 Option;
- The authentication method screen will be shown, with the "Filters" options and "Authentication Methods";
- As of version 9.1.2.24, there has been a few interface changes described below:
- The search screen is shown, where 4 options exist for the filters.
Option | Description |
|---|---|
Type | The type of authentication. There are 2 types: External and Internal.
|
Provider | Here you can inform if the provider is Google, Facebook, or others |
Domain | Inform the authentication domain |
Client Name | Inform the name of the client for authentication |
5. After filling the information in "Filters", if there is an option with the chosen filters, they will be shown on the "Authentication Method" table below;
6. If there is no authentication method, you can create a new one by clicking on "New";
7. When you click on "New", you will be redirected to the creation screen, with 2 tabs to be filled: "Identification" and "Field Mapping";
8. Fill in the "Identification" tab:
Field | Description |
|---|---|
Authentication Type | There are two options "Oauth2 - Internal" and "Oauth2" |
Provider | Here you should inform if the provider is "Google", "Facebook" or "others" If it is Google or Facebook, it's only necessary to inform: Client's Id and Secret Key; If it is Others, it is necessary to inform: Name of the client, the Domain, that should be the same informed on the provider URL fields. |
Client Id | Here you should inform the client id used on the Oauth2 server |
Type of Concession | Identification of the access granted by the authentication provider. This usually contains the value "password" |
Authentication URL | Here you should inform the path to the authentication server |
Client Secret | Here you should inform the client secret as it is on the Oauth2 server |
Situation | Here you can pick if the authentication is active or inactive This situation determines if the system will start the user synchronization process |
Save button | Saves the authentication method |
Delete button | Deletes the authentication method from the database |
Clean button | Erases all the fields |
Search button | Shown on top of the screen, this will return you to the search screen |
9. On the "Field Mapping", you have more fields to fill in:
Field | Description |
|---|---|
Save button | Save the fields |
Erase button | Erases all the fields |
Search button | Shown on top of the screen, this will return to the search screen |
- This tab allows the mapping of information contained in the Oauth2 tokens. On this screen there are two columns, one with the name of the existing fields in the user registration and another with their respective names on Oauth2 tokens;
- The following are the information that can be mapped: ID number, Telephone, and Birth Date;
10. The return URL to CITSmart must be configured through the chosen external authentication platform.