OAuth with Keycloak

Keycloak is an open source identity and access management server, maintained as a Cloud Native Computing Foundation project. Organizations run it to provide single sign-on over OpenID Connect, OAuth 2.0, and SAML, with users, roles, and identity brokering managed per realm.

How does the integration work?

You can use the Keycloak OAuth adapter in Appwrite Auth to sign users in through a realm on your Keycloak server. Appwrite redirects users to the realm's OpenID Connect endpoints, exchanges the authorization code for tokens, and creates an Appwrite user from the user info Keycloak returns. Users keep their identity, policies, and federated logins in Keycloak, and your app gets Appwrite sessions and APIs on top of it.

Appwrite requests the openid, profile, and email scopes, plus offline_access for a refresh token. It marks the user's email as verified only when Keycloak returns email_verified as true.

Prerequisites

• A Keycloak server served over HTTPS. Appwrite calls the realm's token and user info endpoints from the server, so it must be reachable from your Appwrite project.
• Admin access to the realm your users sign in to.

How to implement

To implement the Keycloak OAuth adapter in Appwrite Auth, there are several steps you must complete:

Step 1: Create a client in your Keycloak realm

In the Keycloak admin console, select the realm your users belong to, open Clients, and click Create client.

Configure the client:

• Client type: OpenID Connect.
• Client ID: a name such as appwrite. This is the value you'll enter in Appwrite.
• Client authentication: turn it on, so Keycloak issues a client secret for the client.
• Standard flow: keep it enabled. Appwrite uses the authorization code flow.

You'll fill in Valid redirect URIs after you configure Appwrite in the next step. Save the client, then open its Credentials tab and copy the Client Secret.

Step 2: Add Keycloak OAuth adapter to your Appwrite project

For this step, you must create an account on Appwrite Cloud or self-host Appwrite if you haven't already. In your Appwrite project, head over to the Auth page, open the Settings tab, and click Keycloak under the OAuth2 Providers section.

Fill in the provider form:

• Client ID: the client ID you chose in Keycloak.
• Client Secret: the secret from the client's Credentials tab.
• Domain: the host name of your Keycloak server without https://, for example keycloak.example.com.
• Realm name: the name of the realm, for example appwrite-realm.

Appwrite builds the realm's endpoints as https://<DOMAIN>/realms/<REALM>, so the sign-in page lives at https://keycloak.example.com/realms/appwrite-realm/protocol/openid-connect/auth. Turn the provider on and click Update. Appwrite won't enable the provider until both Domain and Realm name are set.

Copy the Redirect URI shown in the form. On Appwrite Cloud it looks like https://<REGION>.cloud.appwrite.io/v1/account/sessions/oauth2/callback/keycloak/<PROJECT_ID>, but always copy the exact value from the Console. In Keycloak, open the client's settings and add it to Valid redirect URIs, then save.

Step 3: Test the provider

Start a session from your app with the OAuthProvider.Keycloak value. With the Web SDK:

import { Client, Account, OAuthProvider } from 'appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>');

const account = new Account(client);

account.createOAuth2Session({
    provider: OAuthProvider.Keycloak,
    success: 'https://example.com/success',
    failure: 'https://example.com/failed',
});

Add your app's domain as a web platform in your Appwrite project so Appwrite accepts the success and failure URLs. Follow the OAuth 2 login flow for other platforms and for server-side sign-in.

Read more about Keycloak and Appwrite Auth

If you would like to learn more about Keycloak and Appwrite Auth, we have some resources that you should visit: