Keycloak configuration

[mmmccain]

Has anyone else successfully implemented keycloak with oidc-wp? I have it working, but I am not certain of my configuration, especially on the keycloak side of things. Does anyone have a configuration or suggestions they would like to share.

Also, if you have it working, any ideas on how to create a keycloak user from an active Wordpress user (as opposed to the other way around)?

Michael

[timnolte]

@mmmccain just reiterating here for the benefit of others:

This is not something that this plugin would directly provide. How accounts are created is something that is handled by the IDP, in your case Keycloak. There is currently an open draft and call for review on a new specification to signal to an IDP, by a client, to perform a user registration, however this is new and most likely not supported by any IDP yet.

First Public Review Period Started - https://openid.net/2021/12/17/first-public-review-period-for-initiating-user-registration-via-openid-connect-started/
Draft Spec - https://openid.net/specs/openid-connect-prompt-create-1_0-04.html

[mmmccain]

To the first point. Have any others successfully configured openid-connect with keycloak? I currently have it about half working. Not well enough for users (throws errors).

[timnolte]

@mmmccain FYI, I'm working on setting up our own Keycloak instance for testing, as well as creating a set of setup guides in the Wiki for various IDPs.

[mmmccain]

Great news and thank you! If I may assist, please let me know. I will start testing as soon as I post.

[timnolte]

@mmmccain just another heads up that I got my test Keycloak server up and running and I've successfully configured the plugin and everything is working as expected. I'm not using any external Identity Provider along with Keycloak I'm only authenticating directly with Keycloak and once I made some adjustments to the client setup I even have proper client logout going back to the Keycloak server and logging the client out. It's later here so I expect that I'll get the Wiki updated with how I've setup the plugin as well as some basics in how I've setup Keycloak. I can't say that we'll be attempting to provide full documented support for all possible Keycloak setups/configurations as there are a lot of options that can be set, and some options that are not supported with our plugin.

[mmmccain]

I very much look forward to reading your work and thank you. I am confident I am misunderstanding some basics and a functional explanation will be great. Once you have it up, I will make the changes to my own keycloak and client.

If you can provide a fully functional example like you describe above that we can follow, that will be amazing!

Thank you again @timnolte

[timnolte]

@mmmccain FYI, the Keycloak Configuration Guide is published now in the Wiki.

[mmmccain]

Fully implemented. It appears to be solid. I am going to keep hammering on it until tomorrow and then let a few more users at it. I did not need any changes to the client and needed to shut a lot off on the server. @timnolte thank you, fine sir. I will keep you posted. Now for the next question. ;)

[mmmccain]

Rock-solid so far. I still have much to learn, like how to get it to land on the right page after authentication. Thank you for your assistance and contribution to this project. This is why open source works.

[mmmccain]

An odd one and I can file a bug if needed.

If I deselect "Create user if it does not exist" the plugin fails the check for existing user test the first time a current user attempts to login stating the user does not exist. With it selected, it passes the test and the user is allowed to log in. Once they log in once, they are fine and no longer require the selection to be set.

[mmmccain]

Here is the error from the log with "Create user" deselected.

...and here is the log entry for the same user with it selected. Again, user with email cjashley2@protonmail.com is already in the system and was not created, but it will not let cjashley2@protonmail.com log in unless it is selected.