Keycloak Single Sign-On (SSO) TYPO3 OAuth & OpenID | TYPO3 Keycloak SSO

Typo3 OAuth 2.0 Authentication and Authorization Single Sign-On (SSO) extension allows your Frontend & Backend (Admin & Customer) users to seamlessly login into Typo3 site using Keycloak credentials. The Typo3 OAuth / OpenID Connect Single Sign-On (SSO) extension makes it easy to use OAuth2 to set up Keycloak Login on Typo3 (Keycloak Single Sign on).

The Typo3 OAuth & OpenID Connect Single Sign-On (SSO) extension makes it possible to log into Typo3 securely using any OAuth and OpenID Connect provider such as Azure AD, Azure B2C, Okta, Keycloak, Salesforce etc. Advanced Single Sign-On (SSO) features such as user profile Attribute Mapping, Role Mapping, and so on are also supported in this extension. Click here to read more about the Typo3 OAuth Single Sign-On (OAuth & OpenID Connect Client) extensions's premium features.

In this guide, We'll go over how to set up SSO between Typo3 and Keycloak. Users should be able to log in to Typo3 through Keycloak by the end of this guide.

Steps to configure Keycloak OAuth & OpenID Single Sign-On (SSO) Login into Typo3

1. Setup Keycloak as OAuth Provider

Follow the steps below to configure Keycloak as OAuth Provider

 Configure Keycloak as OAuth Provider

• First of all, Download Keycloak and install it.
• Start Server: Start the keycloak server by running the _standalone.sh_ file

  Root Directory of keycloak/bin/standalone.sh

• Add Realm: Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Add Realm option.

• Create Realm: Enter Realm Name and click on CREATE to add realm.
• Create Role: The Role will be used by your applications to define which users will be authorized to access the application. Click on the Roles and choose Add Role.

• Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and choose to Add a new User.

• User Configuration: After user is created following action needs to be performed on it.
• Setting a password for it so click on Credentials and set a new Password for the user.


NOTE : Disabling Temporary will make user password permanent



• Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles and clicking on add selected.

• Create groups: Click on the Groups and choose New to create a new group.

• Assign user to group: Select the user whom you want to add in group. Choose Groups option from tab and then select the group-name and click on join.

• Create OpenID client: Click on the Clients and choose create to create a new client. Enter any random string as Client ID and keep it handy because you will need it in the next step. Select client protocol openeid-connect and select Save.

• Enter Change Access Type: Afterclient is created change it's access type to confidential

• Enter Valid Redirect URLs: Copy callback URL (Enter from miniOrange Typo3 OAuth Single Sign On (SSO) plugin which you copied in the last step) in the last step and then click on SAVE.
  Ex -- https://oauth/callback
• Keycloak Group Mapper: Now to get group details we need to perform its client mapping with group membership else group details will not be fetched. So in client select Mappers and then click on create. Select mapper type Group Membership and enter name and token claim-name i.e the attribute name corresponding which groups will be fetched and click on Save

  Note: -- If full path is on group path will be fetched else group name will be fetched.

• Get Client Secret: Now we need to get client secret. So select Clients and select credentials and copy your secret from here.

You have successfully configured Keycloak as OAuth Provider for achieving Keycloak Single Sign-On (SSO) with Typo3 for user authentication.

2. Configuring Typo3 as OAuth Client

• After successfully configuring OAuth Provider, enter the OAuth Provider Name, Client ID, Client Secret, Scope and provided endpoints.
  
  

  Please refer below Endpoints to configure the OAuth client

  
  

  Scope:	email profile
  Authorize Endpoint:	<Keycloak base URL>/realms/{realm-name}/protocol/openid-connect/auth
  Access Token Endpoint:	<Keycloak base URL>/realms/{realm-name}/protocol/openid-connect/token
  Get User Info Endpoint:	<Keycloak base URL>/realms/{realm-name}/protocol/openid-connect/userinfo

• Click on the Save button to save the settings.

• Click on the Test Configuration button.

• You will see all the values returned by your OAuth Provider to Typo3 in a table. If you don't see value for First Name, Last Name, Email or Username, make the required settings in your OAuth Provider to return this information.
• You have successfully configured your Typo3 as an OAuth Client. Now you can create your custom SSO button in your Typo3 Frontend site and embed the FEOIDC page URL to it to initiate the SSO.

3: Attribute Mapping (Optional). *This is Premium feature.

• You can map attributes in the Attribute Mapping tab. Only username and email are allowed to be mapped in free version of the extension. However, in the premium version of the extension, you can map various attributes coming from your OAuth Provider to the attributes present in your Typo3 site.

4: Group Mapping (Optional). *This is Premium feature.

• You can specify a default role in the free extension that will be allocated to all non-admin users when they conduct SSO.
• Go to Group mapping tab and navigate to Group Mapping section.
• Select the Default Role and click on the Save button.

By configuring Keycloak as an OAuth Provider and Typo3 as an OAuth Client using our Typo3 OAuth Client extension, you have successfully installed Typo3 Keycloak Single Sign-On (SSO). Within minutes, you'll be able to provide safe access to your Typo3 site utilising Keycloak login credentials thanks to this solution.

Additional Resources

• What is Single Sign-On (SSO) Login?
• What is OAuth 2.0?
• How OAuth works?
• Typo3 OAuth and OpenID Single Sign On (SSO) Extension.

If you are looking for anything which you cannot find, please drop us an email on info@xecurify.com