Magento Keycloak Single Sign-On (SSO) | SSO into Magento using Keycloak Credentials

Overview

The Keycloak Magento SSO enables secure and seamless login to your Magento by using Keycloak as your OAuth and OpenID Connect provider. With Keycloak Magento SSO login, users can access the store using Keycloak login credentials. This means with our extension, users of your Keycloak can login into your Magento store using their Keycloak login cedentials.

Our Magento Keycloak Login extension provides secure Single Sign-On (SSO) integration with advanced features like attribute mapping, role mapping, and access control. It enhances site security by ensuring that only verified users can log in or register your Magento site. With a simple Magento Keycloak SSO setup process, the extension streamlines user authentication and improves overall access management. Follow the guide below to install and configure Keycloak Magento SSO effortlessly.

Click here to read more about the Magento OAuth Single Sign-On (OAuth & OpenID Connect Client) extensions extra features.

Download Pricing Plans Schedule a Meeting

Installation Steps

Pre-requisites : Download And Installation

• First of all, Download Keycloak and install it.
• Start the keycloak server based on your keycloak version. (See table below)

Configuration Steps

1. Configure miniOrange SSO Extension

• In the miniOrange Magento SSO extension, navigate to the Application tab, select OAuth/Openid, and click on Keycloak application.

• Copy the Callback URL from the extension. You’ll need this for Keycloak configuration.

2. Setup Keycloak as OAuth Provider for Magento Keycloak SSO Login

• Add Realm : Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Add Realm option.


• Create realm: Enter Realm Name and keep the realm name handy as it will required later to configure the Realm under the OAuth Client plugin. Click on CREATE to add realm.


• Create OpenID client: Click on the Clients and choose create to create a new client. Enter client id and select client protocol openeid-connect and select Save.


• Change Access type: After client is created change its access type to confidential.


• Enter Valid Redirect URIs: Copy callback URL from Magento Keycloak SSO extension and then click on SAVE. Ex -- https:///oauth/callback


• Get Client Secret: Now we need to get client secret. So select Clients and select credentials and copy your secret from here.


• Plugin Configuration: Enter copied Client Secret under Client secret field in the OAuth Client plugin, and enter the Client Name under the Client ID field.
• Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and choose to Add a new User.


• User Configuration: After user is created following action needs to be performed on it.
1) Setting a password for it so click on Credentials and set a new Password for the user.




NOTE : Disabling Temporary will make user password permanent.

• Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles and clicking on add selected.


• Create ROLE: The Role will be used by your applications to define which users will be authorized to access the application. Click on the Roles and choose Add Role.



Step 1.1: Steps to fetch Keycloak Groups [Premium]

• Create groups: Click on the Groups and choose New to create a new group.


• Assign user to group: Select the user whom you want to add in group. Choose Groups option from tab and then select the group-name and click on join.


• Keycloak Group Mapper: Now to get group details we need to perform its client mapping with group membership else group details will not be fetched. So in Client section, select your client and then click on mapper->create.



• Now, select mapper type as Group Membership and enter the name and token claim name i.e the attribute name corresponding to which groups will be fetched. Turn Off the full group path, Add to ID token and Add to access token options, and click on Save.



Note: -- If full path is on group path will be fetched else group name will be fetched.

Step 1.2: Steps to fetch Keycloak Roles [Premium]

• Keycloak Role Mapper: Now to get role details we need to perform its client mapping with role membership else role details will not be fetched. So in Client section, select your client and then click on mapper->create.



• Now, select mapper type as user realm Role Membership and enter the name. and token claim name i.e the attribute name corresponding to which groups will be fetched. Add to ID token and Add to access token options, and click on Save.


• Add Realm : Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Create Realm option.


• Create realm: Enter Realm Name and keep the realm name handy as it will required later to configure the Realm under the OAuth Client plugin. Click on CREATE to add realm.


• Create OpenID client: Click on the Clients and choose Create Client to create a new client. Enter Client id and select client protocol openeid-connect and Click Next.



• Enable the Client Authentication and Authorization toggle.


• Scroll down to the Access settings and enter your Callback/Redirect URL which you will get from Magento Keycloak SSO extension present under the CallBack URLs text-field.


• Go to the Credentials tab, copy the Client Secret and keep it handy as we will require it later while configuring Magento Keycloak SSO extension.


• Plugin Configuration: Enter copied Client Secret under Client secret field in the OAuth Client plugin, and enter the Client ID under the Client ID field.
• Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and Click on Create new user to Add a new User.


• User Configuration: After user is created following action needs to be performed on it.
1) Setting a password for it so click on Credentials and set a new Password for the user.




NOTE : Disabling Temporary will make user password permanent.

• Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles.


• Create ROLE: The Role will be used by your applications to define which users will be authorized to access the application. Click on the Roles and choose Create Role.


• Add Realm : Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Create Realm option.


• Create realm: Enter Realm Name and keep the realm name handy as it will required later to configure the Realm under the OAuth Client plugin. Click on CREATE to add realm.


• Create OpenID client: Click on the Clients and choose Create Client to create a new client. Enter Client id and select client protocol openeid-connect and Click Next.



• Enable the Client Authentication and Authorization toggle.


• Scroll down to the Access settings and enter your Callback/Redirect URL which you will get from Magento Keycloak SSO extension CallBack URLs text-field.


• Go to the Credentials tab, copy the Client Secret and keep it handy as we will require it later while configuring Magento Keycloak SSO extesnion.


• Plugin Configuration: Enter copied Client Secret under Client secret field in the OAuth Client plugin, and enter the Client ID under the Client ID field.
• Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and Click on Create new user to Add a new User.


• User Configuration: After user is created following action needs to be performed on it.
1) Setting a password for it so click on Credentials and set a new Password for the user.




NOTE : Disabling Temporary will make user password permanent.

• Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles.





In conclusion, by successfully configuring Keycloak as OAuth Provider, you have enabled Magento Keycloak SSO Login and authorization for your end users into Magento.

3. Setup Magento as OAuth Client

• Now, Enter the OAuth Provider Name, Client ID, Client Secret, Scope and provided endpoints.
• Please refer the below table for configuring the scope & endpoints for Keycloak Version 18 and above in the extension.

Scope:	email profile openid
Authorize Endpoint:	<keycloak domain>/realms/{realm-name}/protocol/openid-connect/auth
Access Token Endpoint:	<keycloak domain>/realms/{realm-name}/protocol/openid-connect/token
Get User Info Endpoint:	<keycloak domain>/realms/{realm-name}/protocol/openid-connect/userinfo
Custom redirect URL after logout:[optional]	https://{keycloak domain}/realms/{realm-name}/protocol/openid-connect/logout?post_logout_redirect_uri={RedirectUri}&id_token_hint=##id_token##

• Please refer the below table for configuring the scope & endpoints for Keycloak Version 17 and below in the extension .

Scope:	email profile openid
Authorize Endpoint:	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/auth
Access Token Endpoint:	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/token
Get User Info Endpoint:	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/userinfo
Custom redirect URL after logout:[optional]	<keycloak domain>/auth/realms/{realm-name}/protocol/openid-connect/logout?redirect_uri=RedirectUri

• Click on the Save button to save the settings.
• Click on the Test Configuration button.

• You will see all the values returned by your OAuth Provider to Magento in a table. If you don't see value for First Name, Last Name, Email or Username, make the required settings in your OAuth Provider to return this information.



Note: In the Enterprise Version of the extension you can setup multiple providers. To setup a different provider click on the Add Provider button and setup your required provider. You can find the setup guides of all the providers from here.

4. Multisite Settings (*Available in the Enterprise versions)

• Find your Keycloak application and click Edit in the Actions menu.

• Click on Store Configuration from the left-hand menu.
• In the Store Configuration, select the website where you want to activate SSO, and check the Enable SSO for this site option.


 Login Settings

• Show SSO Button on Login Page: Displays the SSO button on the selected website’s customer login page.
• Auto-create Users: You have the option to automatically create customer users during the SSO process if they do not already exist. Enabling the corresponding checkbox activates this feature.
• Auto Redirect Feature: Automatically redirects users to the OAuth Provider login page, either from the Magento login page or from any page on the website.

• Go to customer login page and you will see the SSO button on your frontend. Click on the button and test the SSO.

• You will be sucessfully logged in into Magento.


5. Admin SSO

• Enable SSO for Admins: Displays the SSO button on the Admin login Page.
• Admin SSO Button Text: Sets the label displayed on the SSO button on the admin login page (e.g., Login via Keycloak).
• Auto-create Admin Users: Automatically creates admin user in Magento when they log in via SSO for the first time.
• Auto-Redirect from Admin: Automatically redirects admin users to the OAuth Provider login page from the admin login page.
• Backdoor URL: A backdoor URL allows you to log in to your Admin dashboard using default Admin credentials in case you get locked out.

• Visit your admin login page and you will see the SSO button on your admin page. Click on the button to initate SSO as an admin.

• After sucessfully logged into magento as admin you will be redirect to magento backend dashboard.


6. Headless SSO Settings (*Available in the premium versions)

• Enable for Customers: This option allows you to activate Headless SSO for customers.
• Customer SSO URL: This URL is used to initiate customer SSO from headless applications. Append this SSO URL within your headless application.
  • Example Format:
    https://<your-magento-domain>/mosso/actions/SendSSORequest?relayState={Store_URL}/headless_store_url/{Headless_URL}&app_name=Keycloak AD
  • {Store_URL}: Enter your Magento store URL.
  • {Headless_URL}: Enter the URL of your headless application where the customer token should be sent.
  • After successful SSO, a customer token is sent to the headless URL.
    For example: {Headless_URL}?customer_token=...
• OAuth Token:Enable this option to send the OAuth provider’s (Keycloak) JWT token along with the customer token.
• Customer Token Expiry: You can set the expiration time (in minutes) for the customer token.
• Whitelist Frontend URLs: Here, you can add URLs that are allowed to receive the customer token. The customer token will only be sent to the URL(s) that are whitelisted here.

• Enable for Admins: Similar to customers, this option activates Headless SSO for admins.
• Admin SSO URL: This URL initiates admin SSO from headless applications.
• Admin Token Expiry: Set the expiration time (in minutes) for the admin token.
• Whitelist Frontend URLs: Admin tokens are only sent to the whitelisted URLs here. You must ensure that any URL receiving an admin token is listed.


7. Attribute / Custom Mapping(Optional). *This is Premium feature.

 Customer Attribute Mapping

• Go to the Attribute Mapping section to configure Customer Attribute Mapping.
• Enable Customer Attribute Mapping and select checkbox the option to Update Customer Attributes.

• You will see fields like Email, First Name, and Last Name under Customer Attributes Mapping.
• Map these fields by selecting the appropriate options from the dropdown.
• If you need to add more attributes, click the + Add Customer Attributes button and select the appropriate attribute from the dropdown.




 Customer Address Mapping

• In the Customer Attribute section, enable Address Attribute Mapping and select the checkbox to update Customer Address attributes.

• You will see fields such as Street Address, Zip Code, City, State, and others under Customer Address Mapping.
• Map these fields by selecting the appropriate options from the dropdown.
• If you need to add additional address attributes, click the + Add Address Attributes button and choose the appropriate attribute from the dropdown.


 Admin Attribute Mapping

• In the Admin Attribute Mapping section, enable Admin Attribute Mapping and select the checkbox to update Admin attribute.

• You will see fields like Email, Username First Name, and Last Name under Admin Attributes Mapping.
• Map these fields by selecting the appropriate options from the dropdown.
• If you need to add more attributes, click the + Add Admin Attributes button and select the appropriate attribute from the dropdown.


8. Group/Role Mapping (Optional). *This is Premium feature.

• Magento uses a concept of Roles, designed to give the site owner the ability to control what users can and cannot do within the site. Role mapping helps you to assign specific roles to users of a certain group in your OAuth Provider.
• Select the attribute from your identity provider that contains group/role information for both admin and customer users from the dropdown.


 Customer Group Mapping

• In the Customer Group Mapping settings, the store admin can define which Magento customer group should be assigned based on the group information received from the Identity Provider (IdP) during Single Sign-On (SSO).
• Enable the “Update frontend group on SSO” checkbox if you want Magento to update customer group each time a user logs in via SSO.
• Use the Default Group dropdown to select the Magento Groups that should be assigned to a user when no group information is returned by the Identity Provider or when the received group does not match any configured mapping.

• Enter the Identity Provider group values against the corresponding Magento customer groups as required.
• Users belonging to a specific group in the Identity Provider will be automatically assigned the mapped Magento group during SSO.
• Example: If the group value from the Identity Provider is mapped to the General group in Magento, any user with that group in the IdP will be assigned the General customer group upon SSO.


 Admin Role Mapping

• Enable the “Update Backend roles on SSO” checkbox if you want Magento to update Admin roles each time a user logs in via SSO.
• Use the Default Group dropdown to select the Magento role that should be assigned to a user when no group information is returned by the Identity Provider or when the received group does not match any configured mapping.

• Enter the Identity Provider group values against the corresponding Magento Admin roles as required.
• Users belonging to a specific group in the Identity Provider will be automatically assigned the mapped Magento group during SSO.
• Example: If the group value from the Identity Provider is mapped to the General group in Magento, any user with that group in the IdP will be assigned the General Admin roles upon SSO.


Additional Resources

• Magento Security Solutions
• What is Single Sign-On (SSO) Login?
• Okta's developer documentation for OAuth 2.0 & OpenID Connect
• Seamless Okta WordPress SSO Integration: Learn About Okta and OAuth
• Magento OAuth Single Sign On (SSO) Plugin.

Get in Touch

Please reach out to us at magentosupport@xecurify.com, and our team will assist you with setting up the Magento 2 SSO (OAuth/OIDC) Extension. Our team will help you to select the best suitable solution/plan as per your requirement.