KeyCloak

Running KeyCloak with Docker

You may easily run KeyCloak in a development environment using Docker with the following command: docker run --name keycloak --publish 8081:8080 --hostname keycloak -e DB_VENDOR=h2 -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=<admin_pass> jboss/keycloak

KeyCloak Configuration

Create an application within the desired realm with:

• Client Protocol: openid-connect
• Implicit Flow Enabled: Yes
• Access Type: confidential
• Redirect URIs
  • <root url>/login (ex: https://trifolia-fhir-dev.lantanagroup.com/silent-refresh.html)
  • <root url>/silent-refresh.html (ex: https://trifolia-fhir-dev.lantanagroup.com/silent-refresh.html)

ToF Configuration

• auth.clientId = keycloak app's "Client ID"
• auth.domain = <the publicly available url of the tof app>
• auth.scope = openid profile name email roles
• auth.secret = keycloak app > Credentials tab > "Secret"
• auth.issuer = <keycloak url>/auth/realms/<realm id>
• auth.jwksUri = <keycloak url>/auth/realms/<realm id>/protocol/openid-connect/certs

Administrator role

An admin role can be assigned to users so that they are recognized as an administrative user.

Add the role to the client app:

1. From the KeyCloak admin panel, click "Clients" and select the app you created for ToF
2. Select the "Roles" tab
3. Click "Add Role"
4. The role name must be "admin"
5. Click "Save"

Have KeyCloak return the roles in the id token:

1. From the KeyCloak admin panel, click "Client Scopes"
2. Click "roles"
3. Select "On" for "Include in Token Scope"
4. Select "Mappers" tab
5. Click "client roles"
6. Change the "Token Claim Name" to "roles"
7. Make sure the "On" is selected for both "Add to ID token" and "Add to access token"

Assign users as an admin

1. In the KeyCloak admin dashboard, select "Users" on the left
2. Click the ID of the user you want to make an admin
3. Select the "Role Mappings" tab
4. In the "Client Roles" drop-down menu, select the app for ToF
5. Under "Available Roles" select/highlight the "admin" role
6. Click "Add selected"