[keycloak-user] R: R: Need to log in to all realms with unique admin users

Dmitrij, thanks for your detailed explanations, I followed them and managed to use the broker. However, I could not use "Automatically Link Brokered Account". I did not understand what I have to do to enable it. First of all I increased the version of the project dependency and the keycloak server to version 4.5.0, so as to have all the features available. Here are my doubts after having said this solution: 1. If you are logged in to the realm master, via the admin console site, when you click on the broker's link, to login the client application with a realm master user, the realm master login is not displayed, because it is used account that is logged in at that time. This implies the limitation of NOT using simultaneously the admin console site and the client application. 2. After logging in, using the broker's link on the client application, if I try to log out, the latter is done on the client application but if I log in to the admin console site it detects my last login. It is as if NOT logged out by all clinets (client application and site admin console) 3. Once logged in, using the broker's link on the client application, the user is duplicated from the realm master to the client application realm. So, I have a question: For the next accesses, will I always have to use the link or will I have to insert only username and password in the client application login form? Any changes to the user on the realm master will be automatically propagated on the duplicates of the other realms? In which cases, only when the broker link is used? 4. Is there not a way to share only the users' databases, without having to have fifteen duplications on the realms other than the master one? For example, as a User Federation. 5. Are there any other possible solutions? Or do you have any suggestion to propose? Thank you Mattia Bello Developer Horsa S.p.A. Via Cadorna, 67 Vimodrone (MI) Mobile (+39) 340 36 07 937 www.horsa.it ________________________________________ Da: Dmitry Telegin [dt(a)acutus.pro] Inviato: martedì 30 ottobre 2018 5.18 A: Mattia Bello; keycloak-user(a)lists.jboss.org Oggetto: Re: R: [keycloak-user] Need to log in to all realms with unique admin users Ciao Mattia, Let's assume your realm (non-master) is named "foo". Here are the steps: 1. In admin console, go to master realm -> clients -> broker -> Credentials, copy the secret; 2. go to foo realm -> Identity Providers, add Keycloak OpenID Connect provider, give it an alias (like "master"); 3. set Client ID to "broker" (w/o quotes) and paste the Client Secret; 4. scroll down to "Import from URL", paste the following: https://urlsand.esvalabs.com/?u=http%3A%2F%2Flocalhost%3A8180%2Fauth%2Fre... and click Import. The necessary fields will be filled in automatically; 5. scroll up, copy Redirect URI (should be like https://urlsand.esvalabs.com/?u=http%3A%2F%2Flocalhost%3A8180%2Fauth%2Fre... ); 6. go to master realm -> clients -> broker, paste the URI to "Valid Redirect URIs", click save. After that, your users will be able authenticate on non-master realms via the master realm. Upon the first successful login, the user will be presented with the Update Account Information form. If you want to bypass that, you can enable identity auto-linking. For Keycloak 4.5.0, it's out of the box - just use "Automatically Link Brokered Account" authenticator in your first broker login flow. For Kyecloak <4.5.0, you can use this: https://urlsand.esvalabs.com/?u=https%3A%2F%2Fgithub.com%2Fohioit%2Fkeycl... Good luck! Dmitry Telegin CTO, Acutus s.r.o. Keycloak Consulting and Training Pod lipami street 339/52, 130 00 Prague 3, Czech Republic +42 (022) 888-30-71 E-mail: info(a)acutus.pro On Mon, 2018-10-29 at 15:09 +0000, Mattia Bello wrote: OpenID Endpoint Configuration link: th/realms/master", realms/master/protocol/openid-connect/auth", calhost:8180/auth/realms/master/protocol/openid-connect/token", ntrospection_endpoint":" https://urlsand.esvalabs.com/?u=http%3A%2F%2Flocalhost%3A8180%2Fauth%2Fre... ol/openid-connect/token/introspect", st:8180/auth/realms/master/protocol/openid-connect/userinfo", on_endpoint":" https://urlsand.esvalabs.com/?u=http%3A%2F%2Flocalhost%3A8180%2Fauth%2Fre... connect/logout", otocol/openid-connect/certs", 180/auth/realms/master/protocol/openid-connect/login-status- iframe.html", "refresh_token", "password", "client_credentials"], orted":["code","none","id_token","token","id_token token","code> id_token","code token","code id_token token"], :["public","pairwise"], ], ning_alg_values_supported":["none","RS256"], ["query","fragment","form_post"], ost:8180/auth/realms/master/clients-registrations/openid-connect", n_endpoint_auth_methods_supported":["private_key_jwt","client_secret_ba sic", "client_secret_post","client_secret_jwt"], gning_alg_values_supported":["RS256"], auth_time","name","given_name", l"], se, ne","profile"], r_supported":true, tls_client_certificate_bound_access_tokens":true the form, as you can see from the image attached. the TECNICO link inl ogin form, the keycloak page return this message: server logs are: task-21) type=LOGIN_ERROR, realmId=master, clientId=risolvo-app,> userId=null, ipAddress=127.0.0.1, error=invalid_redirect_uri,> redirect_uri= https://urlsand.esvalabs.com/?u=http%3A%2F%2Flocalhost%3A8180%2Fauth%2Fre... oidc/endpoint