Part 2: Keycloak Integration with Sitecore
This blog will cover the process of setting up Keycloak with Sitecore content management, building upon the explanation provided in the Part 1 blog on Keycloak Integration with Sitecore.
Step 1: Configure OpenID Connect
Create a pipeline processor to configure OpenID connect to talk to Keycloak identity providers.
public class KeycloakIdentityProvider : IdentityProvidersProcessor
{
protected override string IdentityProviderName => "keycloak";
private string ClientId => Settings.GetSetting(KeycloakSettings.ClientId, "");
private string ClientSecret => Settings.GetSetting(KeycloakSettings.ClientSecret, "");
private string Authority => Settings.GetSetting(KeycloakSettings.Authority, "");
private string MetadataAddress => Settings.GetSetting(KeycloakSettings.MetadataAddress, "");
private string RedirectURL => Settings.GetSetting(KeycloakSettings.RedirectURL, "");
private readonly string OpenIdScope = OpenIdConnectScope.OpenIdProfile + " email";
private readonly string idToken = "id_token";
private readonly string accessDeniedRelativePath = "/custom/errorpages/Forbidden.aspx";
public KeycloakIdentityProvider(FederatedAuthenticationConfiguration federatedAuthenticationConfiguration, Microsoft.Owin.Infrastructure.ICookieManager cookieManager, BaseSettings settings) : base(federatedAuthenticationConfiguration, cookieManager, settings)
{
}
protected IdentityProvider IdentityProvider { get; set; }
protected override void ProcessCore(IdentityProvidersArgs args)
{
IdentityProvider = this.GetIdentityProvider();
var httphandler = new HttpClientHandler();
httphandler.DefaultProxyCredentials = CredentialCache.DefaultCredentials;
httphandler.CheckCertificateRevocationList = true;
httphandler.ServerCertificateCustomValidationCallback = (message, cert, chain, sslPolicyErrors) =>
{
return true;
};
var options = new OpenIdConnectAuthenticationOptions
{
BackchannelHttpHandler = httphandler,
//Backchannel = httpclient,
RequireHttpsMetadata = false,
MetadataAddress = MetadataAddress,
ClientId = ClientId,
ClientSecret = ClientSecret,
Authority = Authority,
RedirectUri = RedirectURL,
ResponseType = OpenIdConnectResponseType.Code,
Scope = OpenIdScope,
AuthenticationType = IdentityProvider.Name,
RedeemCode = true,
TokenValidationParameters = new TokenValidationParameters
{
NameClaimType = "name"
},
Notifications = new OpenIdConnectAuthenticationNotifications
{
RedirectToIdentityProvider = notification =>
{
if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)
{
if (Sitecore.Context.User.IsAuthenticated)
{
notification.HandleResponse();
notification.Response.Redirect(Settings.GetSetting("Identity.sso.launchpad"));
}
else
{
notification.ProtocolMessage.SetParameter("kc_idp_hint", "saml");
}
}
if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
{
// If signing out, add the id_token_hint
var idTokenClaim = notification.OwinContext.Authentication.User.FindFirst(idToken);
if (idTokenClaim != null)
notification.ProtocolMessage.IdTokenHint = idTokenClaim.Value;
}
return System.Threading.Tasks.Task.CompletedTask;
}
}
};
args.App.UseKentorOwinCookieSaver();
args.App.UseOpenIdConnectAuthentication(options);
}
}
Step 2: Patch File
Create a patch file that will register a Keycloak Sitecore identity.
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/"
xmlns:env="http://www.sitecore.net/xmlconfig/env/" xmlns:zone="http://www.sitecore.net/xmlconfig/zone/">
<sitecore role:require="ContentManagement or Standalone">
<settings>
<setting name="Identity.Keycloak.ClientId" value="VALUE"/>
<setting name="Identity.Keycloak.ClientSecret" value="VALUE"/>
<setting name="Identity.Keycloak.Authority" value="VALUE"/>
<setting name="Identity.Keycloak.MetadataAddress" value="VALUE"/>
<setting name="Identity.Keycloak.RedirectURL" value="VALUE"/>
</settings>
<pipelines>
<owin.identityProviders>
<processor type="WEBSITE.KeycloakIdentityProvider, WEBSITE" resolve="true" />
</owin.identityProviders>
</pipelines>
<federatedAuthentication type="Sitecore.Owin.Authentication.Configuration.FederatedAuthenticationConfiguration, Sitecore.Owin.Authentication">
<identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
<mapEntry name="all sites" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
<sites hint="list">
<site>regexp:.*</site>
</sites>
<identityProviders hint="list:AddIdentityProvider">
<identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='keycloak']" />
</identityProviders>
</mapEntry>
</identityProvidersPerSites>
<identityProviders hint="list:AddIdentityProvider">
<identityProvider id="keycloak" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication">
<param desc="name">$(id)</param>
<param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
<caption>Log in with keycloak</caption>
<icon>/sitecore/shell/themes/standard/Custom/24x24/msazure.png</icon>
<domain>sitecore</domain>
<enabled>true</enabled>
<transformations hint="list:AddTransformation">
</transformations>
</identityProvider>
</identityProviders>
<propertyInitializer type="Sitecore.Owin.Authentication.Services.PropertyInitializer, Sitecore.Owin.Authentication">
<maps hint="list">
</maps>
</propertyInitializer>
</federatedAuthentication>
</sitecore>
</configuration>
Comments