An open source solution pre-built from professionals like Ory Kratos or Keycloak saves you a lot of time and pain.
Keycloak in itself is a pain to manage as well. Without Terraform, you're lost... and integrating stuff with Keycloak is a pain as well. I've tried and failed to integrate a self-hosted GitLab instance, for example - their docs [1] don't specify anything how the Keycloak config is supposed to look like, the next best Google hit doesn't either [2], and somewhen in the last two years the third Google hit [3] got outdated - the Keycloak OIDC configuration UI got completely reorganized and renamed. Other stuff like Atlassian is a pain to integrate with Keycloak OIDC as well.
So, if anyone could point me to a working configuration for modern Keycloak and GitLab, I'd be really thankful. And if doc writers could specify a working Terraform, Ansible or whatever code that specifies the Keycloak configuration the application understands, I'd be even more thankful. OIDC is a horrible mess, I get it, but if your users can't get it to work because you specify nowhere what exact flavor and quirks of OIDC your application need, it reflects badly not just on Keycloak but on your application as well.
Based on [1], I believe I can guide you through that:
Given that your keycloak instance is running (and accessible to the user browser) at https://mykeycloak.net, its version is 17 or higher and you are using the realm named _master_.
3 - Set args.issuer.client_options.identifier to `gitlab`
4 - Set args.issuer.client_options.secret to CLIENT_SECRET
Hope that helps. If that works for you, please write a public markdown github gist with this tutorial and the title "how to configure gitlab with keycloak?" this will help future google searchers. Be sure to reinclude the question "how to configure gitlab with keycloak?" as a title inside the gist, with the tutorial following, as google favors question and answer style.
I don’t have the code handy because I’m on my phone but we use keycloak for archlinux.org. You should be able to find the terraform and config for it all on our gitlab instance.
Comments
Keycloak in itself is a pain to manage as well. Without Terraform, you're lost... and integrating stuff with Keycloak is a pain as well. I've tried and failed to integrate a self-hosted GitLab instance, for example - their docs [1] don't specify anything how the Keycloak config is supposed to look like, the next best Google hit doesn't either [2], and somewhen in the last two years the third Google hit [3] got outdated - the Keycloak OIDC configuration UI got completely reorganized and renamed. Other stuff like Atlassian is a pain to integrate with Keycloak OIDC as well.
So, if anyone could point me to a working configuration for modern Keycloak and GitLab, I'd be really thankful. And if doc writers could specify a working Terraform, Ansible or whatever code that specifies the Keycloak configuration the application understands, I'd be even more thankful. OIDC is a horrible mess, I get it, but if your users can't get it to work because you specify nowhere what exact flavor and quirks of OIDC your application need, it reflects badly not just on Keycloak but on your application as well.
/rant
[1] https://docs.gitlab.com/ee/administration/auth/oidc.html#con...
[2] https://github.com/ChathuminaVimukthi/Gitlab-SSO-implementat...
[3] https://dheeruthedeployer.medium.com/gitlab-integration-with...
Based on [1], I believe I can guide you through that:
Given that your keycloak instance is running (and accessible to the user browser) at https://mykeycloak.net, its version is 17 or higher and you are using the realm named _master_.
Given that your gitlab is at https://gitlab.example.com.
At keycloak:
1 - create a new client, name it `gitlab` and set https://gitlab.example.com/users/auth/openid_connect/callbac... as the root url (henceforth CALLBACK_URI)
At keycloak, in the `gitlab` client settings screen, tab settings:
1 - Set `acess type` to `confidential`.
2 - Set `Direct Access Grants Enabled` to off.
3 - Set `Valid Redirect URIs` to `https://gitlab.example.com/users/auth/openid_connect/callbac...`* (that is the CALLBACK_URI followed by a *)
4 - Save it (A previously hidden credentials appear in the settings screen.)
At keycloak, in the `gitlab` client settings screen, tab credentials:
1 - note down your client secret (something like HMPhR89hoxrcotAz9vWjEAlPCWRAx2MP), henceforth CLIENT_SECRET
At your gitlab instance config file, setting gitlab_rails['omniauth_providers']:
1 - Set the content as in [1]
2 - Set args.issuer to https://mykeycloak.net/realms/master
3 - Set args.issuer.client_options.identifier to `gitlab`
4 - Set args.issuer.client_options.secret to CLIENT_SECRET
Hope that helps. If that works for you, please write a public markdown github gist with this tutorial and the title "how to configure gitlab with keycloak?" this will help future google searchers. Be sure to reinclude the question "how to configure gitlab with keycloak?" as a title inside the gist, with the tutorial following, as google favors question and answer style.
[1] = https://docs.gitlab.com/ee/administration/auth/oidc.html#con...
Sadly, this does not work. The logs aren't exactly useful either:
==> /var/log/gitlab/nginx/gitlab_access.log <== 100.107.130.186 - - [23/Dec/2022:16:15:01 +0000] "POST /users/auth/openid_connect HTTP/1.1" 302 107 "https://git-xxx.xxx.de/users/sign_in" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" -
==> /var/log/gitlab/gitlab-rails/application.log <== 2022-12-23T16:15:01.709Z: (openid_connect) Request phase initiated. 2022-12-23T16:15:01.735Z: (openid_connect) Authentication failure! Not Found: OpenIDConnect::Discovery::DiscoveryFailed, Not Found
==> /var/log/gitlab/gitlab-rails/application_json.log <== {"severity":"DEBUG","time":"2022-12-23T16:15:01.709Z","correlation_id":"01GMZW8DH3E10E8NBYKC65MCYR","message":"(openid_connect) Request phase initiated."} {"severity":"ERROR","time":"2022-12-23T16:15:01.735Z","correlation_id":"01GMZW8DH3E10E8NBYKC65MCYR","message":"(openid_connect) Authentication failure! Not Found: OpenIDConnect::Discovery::DiscoveryFailed, Not Found"}
Bring this to keycloak forum and I'll help.
I don’t have the code handy because I’m on my phone but we use keycloak for archlinux.org. You should be able to find the terraform and config for it all on our gitlab instance.