Panel SSO with Keycloak
Tags: keycloak, sso, oauth, jupyter
Published: 2023-03-01 20:40:18

Over last few years, [Panel](https://panel.holoviz.org/index.html) has gained lots of popularity thro’ its unlimited list of features to fetch, analyze, present any and all types of data and bring familiar python tools. And all this, without having to write a single line of UI code (You can, if you really want to). There is a lot that has been written about Panel features and its capabilities. This post is primarily around connecting and authenticating panel with oAuth.

Panel has a built in [authentication](https://panel.holoviz.org/index.html) and authorization framework. Out of the box, Panel supports

- 1. azure
- 2. bitbucket
- 3. github
- 4. gitlab
- 5. google
- 6. okta
In addition to this, Panel can also connect to any generic oAuth provider. One that I definitely wanted to work with is [Keycloak](http://www.keycloak.org/) which is missing from this list. This is not well documented, however its really easy to do. This can be done in one of the two ways.

**Environment Variable**
You can setup following env variable with appropriate values. This will be covered in detail in Keycloak example.

```
export PANEL_OAUTH_KEY
export PANEL_OAUTH_SECRET
export PANEL_OAUTH_AUTHORIZE_URL
export PANEL_OAUTH_TOKEN_URL
export PANEL_OAUTH_USER_URL
export PANEL_COOKIE_SECRET
export PANEL_OAUTH_REDIRECT_URL
```
**Command Line Parameter**
You can pass following parameters with appropriate values thro’ command line to panel runtime.

```panel serve MyAnalysis.py --oauth-provider=generic \
--oauth-key=ClientID --oauth-secret=SECRET --cookie-secret=panel \
--oauth-redirect-uri="multiple_pages" --oauth-extra-params="{'TOKEN_URL':'', 'AUTHORIZE_URL':'', 'USER_URL':''}"```

### Setting Keycloak for oAuth SSO
#### Setup client :

##### Create a Realm
Create client inside that realm. Make sure you choose Access Type as Confidential
Fill out other URL appropriately

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mgv5p7s9k2o51pc4xi0r.png)


Access Type should be confidential
Get oAuth URLs

Get client Secret and copy to `PANEL_OAUTH_SECRET`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rc21r9phqxvk0ru270bw.png)



Go to Realm Setting → General → Endpoints
Click on `OpenID Endpoint Configuration`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/whsovq2yzrdgxzznkp2z.png)



Note down following URLs

```
"authorization_endpoint": "http://localhost:8080/realms/myrealm/protocol/openid-connect/auth",
"token_endpoint": "http://localhost:8080/realms/myrealm/protocol/openid-connect/token",
"introspection_endpoint": "http://localhost:8080/realms/myrealm/protocol/openid-connect/token/introspect",
"userinfo_endpoint": "http://localhost:8080/realms/myrealm/protocol/openid-connect/userinfo",
"end_session_endpoint": "http://localhost:8080/realms/myrealm/protocol/openid-connect/logout",
```

Export these as Env Variables

```
export PANEL_OAUTH_KEY=panel-sso
export PANEL_OAUTH_SECRET="Pm8Bcs6QgygjaiyxRxSTfPpIzUkW40lM"
export PANEL_OAUTH_AUTHORIZE_URL="http://localhost:8080/realms/myrealm/protocol/openid-connect/auth"
export PANEL_OAUTH_TOKEN_URL="http://localhost:8080/realms/myrealm/protocol/openid-connect/token"
export PANEL_OAUTH_USER_URL="http://localhost:8080/realms/myrealm/protocol/openid-connect/userinfo"
export PANEL_COOKIE_SECRET="bZJc2sWbQLKos6GkHn/VB9oXwQt8S0R0kRvJ5/xJ89E="
export PANEL_OAUTH_REDIRECT_URL="http://localhost:5006"
```
#### Run panel with generic SSO

`panel serve my_pages.py --oauth-provider=generic`
You should be able to see keycloak login

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8eyb49x2wve3n00z8jo7.png)


### Conclusion
Panel is an amazing tool. Being able to connect with any generic oAuth provider is simple and should make it securely accessible.