Skip to main content

Keycloak

This short tutorial shows how to set up Studo Flow's OIDC login provider with Keycloak. Users from the Keycloak realm then should be able to log in to Studo Flow.

You can follow this tutorial to configure your Keycloak, or use it as a reference point to configure a different OIDC-compatible identity provider.

Prerequisites​

This tutorial assumes the following setup:

  • A Keycloak server instance
  • A provisioned Flow server with a valid licence and reachable web interface
  • A working networking setup where the Flow server and Keycloak can communicate

Create a Keycloak client​

First we will configure Keycloak by creating a client in the Keycloak web UI for Flow.

  1. Select the desired Keycloak realm, click on Clients then click on Create.
  2. As Client Protocol use "openid-connect".
  3. Set a Client ID (for this tutorial we will use "studo-flow").
  4. Choose a name and description. E.g. "Studo Flow" (these values don't impact functionality).
  5. Click Next.
  6. Set Client authentication to "On" to configure the client to be confidential.
  7. Enable the Standard Authentication flow.
  8. Optional: Select "S256" as PKCE Method to enforce Proof Key for Code Exchange for the client
  9. Click Next.
  10. As Root URL use the following pattern "https://<FLOW_DOMAIN>" (e.g. https://demo.studoflow.com/).
  11. Add "/*" as Valid Redirect URIs.
  12. Click Save.
  13. Scroll to the Logout settings
    • Set Front Channel Logout to "Off".
    • Set Backchannel logout URL to the correct URL (backchannel logout).
    • Set Backchannel Logout Session Required to "On".
  14. Switch to the Client Scopes tab and make sure that Assigned Default Client Scopes has the scope "email".
  15. Switch to the Credentials tab and make sure that Client Authenticator is set to "Client Id and Secret".
  16. Make sure Enabled (very top) is true.
  17. Click Save.