keycloak + Azure Active Directory
Tags: azure, keycloak, idp, security
Published: 2021-06-13 15:41:43

<!-- wp:paragraph {"fontSize":"normal"} -->
<p class="has-normal-font-size">Hi folks!</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In this post, I'm going to write about keycloak and Microsoft Azure Active Directory (AD).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>I have decided to write this post for two reasons: first, in my current job (02/2021), we need to integrate between keycloak and active directory because a customer uses azure AD, and second because I had a lot of difficulties searching for other posts on the subject to configure the keycloak and AD. So go ahead.</p>
<!-- /wp:paragraph -->

<!-- wp:group -->
<div class="wp-block-group"><!-- wp:heading {"level":1} -->
<h1>Register an app in Azure Active Directory</h1>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Acess the <a rel="noreferrer noopener" href="https://portal.azure.com/#home" target="_blank">Microsoft azure</a> portal and click in Azure Active Directory</p>
<!-- /wp:paragraph --></div>
<!-- /wp:group -->

<!-- wp:image {"align":"center","id":42,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/02/azure_dashboard.png?w=1024" alt="" class="wp-image-42"/><figcaption>Access from dashboard</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:image {"align":"center","id":44,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/02/azure_menu_ad.png?w=212" alt="" class="wp-image-44"/><figcaption>Acess from menu</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>When you click on the menu, you'll be to redirect to the tenant overview. If you don't have any tenants, please see the <a rel="noreferrer noopener" href="https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-access-create-new-tenant" target="_blank">quickstart</a> to create a new tenant.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":46,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/02/azure_ad_overview.png?w=1024" alt="" class="wp-image-46"/><figcaption>The tenant overview</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:heading -->
<h2>Registering a new app</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>On this page search for the <em>App registrations</em> menu, click it to show the App registrations page.<br>After this we'll register a new app. So, click on <em>New registration</em> to go to the app registration page. </p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":48,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/02/azure_app_registration_new.png?w=624" alt="" class="wp-image-48"/><figcaption>Menu <em>App registrations</em> and <em>New registration</em> menu.</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>On the <em>Register an application</em>, write a <em>Name</em>, select the <em>Accounts in this organizational directory only</em> and click on <em>Register</em>.<br>After you click on <em>Register</em>, you'll be redirected to the new app overview page.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":51,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/02/azure_ad_register_app.png?w=678" alt="" class="wp-image-51"/><figcaption>Registering the new application</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:image {"align":"center","id":53,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/02/azure_ad_new_app_registration_overview.png?w=1024" alt="" class="wp-image-53"/><figcaption>The new application - overview</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:heading -->
<h2>Client secrets</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Now on this page, we'll go to the <em>Certificates &amp; secrets</em> menu. Clicking on the menu, a screen will appear and we'll see <em>Certificates</em> and <em>Client secrets</em> below. On <em>Client secrets</em>, click on <em>New client secret</em> to open a window to register a new client secret.<br></p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":60,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/02/azure_ad_client_secrets_new.png?w=1024" alt="" class="wp-image-60"/></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Write a <em>Description</em> (optional), choose an <em>Expires</em>, and click on <em>Add</em>. After this new client secrets will appear on the table below. <br>Copy the <em><strong>Value</strong></em> and save it, because after you won't be able to see the value again.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":61,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/02/azure_ad_client_secrets_created_copy_value.png?w=984" alt="" class="wp-image-61"/><figcaption>Save the <em>Value</em> and <em>ID</em>, we need this information later. Now that you have done it,  we need to configure the keycloak.</figcaption></figure>
<!-- /wp:image -->

<!-- wp:heading {"level":1} -->
<h1>Configuring keycloak</h1>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Now we need to configure the keycloak. <br>First, we'll create a realm, but if you already have a realm, go to the <em>Configuring an Identity Providers</em></p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Creating a realm</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>If you don't have yet a realm, It is easy to create a realm in keycloak. <br>In the left menu, above <strong>Configure</strong>, pass the mouse over the <em>realm name</em> and click in <strong>Add realm</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:group -->
<div class="wp-block-group"><!-- wp:columns {"verticalAlignment":"top"} -->
<div class="wp-block-columns are-vertically-aligned-top"><!-- wp:column {"verticalAlignment":"top","width":"100%"} -->
<div class="wp-block-column is-vertically-aligned-top" style="flex-basis:100%"><!-- wp:jetpack/tiled-gallery {"className":"is-style-columns","columnWidths":[["50.65647","49.34353"]],"ids":[104,112]} -->
<div class="wp-block-jetpack-tiled-gallery aligncenter is-style-columns"><div class="tiled-gallery__gallery"><div class="tiled-gallery__row"><div class="tiled-gallery__col" style="flex-basis:50.65647%"><figure class="tiled-gallery__item"><img alt="" data-height="2048" data-id="104" data-link="https://andremoriya.wordpress.com/create_realm1-2/" data-url="https://andremoriya.files.wordpress.com/2021/04/create_realm1-edited.png" data-width="1272" src="https://andremoriya.files.wordpress.com/2021/04/create_realm1-edited.png" data-amp-layout="responsive"/></figure></div><div class="tiled-gallery__col" style="flex-basis:49.34353%"><figure class="tiled-gallery__item"><img alt="" data-height="362" data-id="112" data-link="https://andremoriya.wordpress.com/add_realm-2/" data-url="https://andremoriya.files.wordpress.com/2021/04/add_realm-2.png" data-width="219" src="https://andremoriya.files.wordpress.com/2021/04/add_realm-2.png" data-amp-layout="responsive"/></figure></div></div></div></div>
<!-- /wp:group -->

<!-- wp:group -->
<div class="wp-block-group"></div>
<!-- /wp:group -->

<!-- wp:paragraph -->
<p>Just type a name and click on <strong>Create.</strong></p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":113,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/image-1.png?w=991" alt="" class="wp-image-113"/></figure>
<!-- /wp:image -->

<!-- wp:heading -->
<h2>Configuring a <em>Identity Providers</em></h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>On the left menu, go to the <strong>Identity Providers<em> </em></strong>menu.<br>On <em>Add provider</em>, select the <em>OpenID connect V1.0</em>.</p>
<!-- /wp:paragraph -->

<!-- wp:columns {"verticalAlignment":"top"} -->
<div class="wp-block-columns are-vertically-aligned-top"><!-- wp:column {"verticalAlignment":"top","width":"100%"} -->
<div class="wp-block-column is-vertically-aligned-top" style="flex-basis:100%"><!-- wp:group -->
<div class="wp-block-group"><!-- wp:jetpack/tiled-gallery {"columnWidths":[["100.00000"],["100.00000"]],"ids":[115,118]} -->
<div class="wp-block-jetpack-tiled-gallery aligncenter is-style-rectangular"><div class="tiled-gallery__gallery"><div class="tiled-gallery__row"><div class="tiled-gallery__col" style="flex-basis:100%;"><figure class="tiled-gallery__item"><img alt="" data-height="521" data-id="115" data-link="https://andremoriya.wordpress.com/?attachment_id=115" data-url="https://andremoriya.files.wordpress.com/2021/04/keycloak_identity_provider_add.png" data-width="1325" src="https://andremoriya.files.wordpress.com/2021/04/keycloak_identity_provider_add.png" data-amp-layout="responsive" /></figure></div></div><div class="tiled-gallery__row"><div class="tiled-gallery__col" style="flex-basis:100%;"><figure class="tiled-gallery__item"><img alt="" data-height="461" data-id="118" data-link="https://andremoriya.wordpress.com/keycloak_identity_provider_add_oidc-1/" data-url="https://andremoriya.files.wordpress.com/2021/04/keycloak_identity_provider_add_oidc-1.png" data-width="1168" src="https://andremoriya.files.wordpress.com/2021/04/keycloak_identity_provider_add_oidc-1.png" data-amp-layout="responsive" /></figure></div></div></div></div>
<!-- /wp:jetpack/tiled-gallery -->

<!-- wp:paragraph -->
<p>After this, the window <em>Add identity provider</em> will open.<br><br>Type an <em>Alias</em>, and a <em>Display Name</em> if you want. After, Go to the <strong>Import External IDP Config</strong>, and see the <em>Import from URL</em> field.<br>Now we need to back to the Azure AD, access the application on <em>App registration</em>, and see the <em><strong>Endpoints.</strong></em></p>
<!-- /wp:paragraph -->

<!-- wp:jetpack/tiled-gallery {"columnWidths":[["100.00000"],["100.00000"]],"ids":[120,123]} -->
<div class="wp-block-jetpack-tiled-gallery aligncenter is-style-rectangular"><div class="tiled-gallery__gallery"><div class="tiled-gallery__row"><div class="tiled-gallery__col" style="flex-basis:100%;"><figure class="tiled-gallery__item"><img alt="" data-height="549" data-id="120" data-link="https://andremoriya.wordpress.com/?attachment_id=120" data-url="https://andremoriya.files.wordpress.com/2021/04/azure_ad_new_app_registration_overview.png" data-width="1312" src="https://andremoriya.files.wordpress.com/2021/04/azure_ad_new_app_registration_overview.png" data-amp-layout="responsive" /></figure></div></div><div class="tiled-gallery__row"><div class="tiled-gallery__col" style="flex-basis:100%;"><figure class="tiled-gallery__item"><img alt="" data-height="996" data-id="123" data-link="https://andremoriya.wordpress.com/endpoints/" data-url="https://andremoriya.files.wordpress.com/2021/04/endpoints.png" data-width="2048" src="https://andremoriya.files.wordpress.com/2021/04/endpoints.png" data-amp-layout="responsive" /></figure></div></div></div></div>
<!-- /wp:jetpack/tiled-gallery -->

<!-- wp:paragraph -->
<p></p>
<!-- /wp:columns -->

<!-- wp:paragraph -->
<p>Copy the <em>OpenID Connect metadata document</em> information and back to the keycloak.<br><br>In <em>Import for URL</em> paste the metadata copied above, and click on the <em>Import</em> button.<br><br>That done, some settings must appear in <em>OpenID Connect Config</em> as shown in the image below</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":124,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/keycloak_identity_provider_oidc_conect_config.png?w=722" alt="" class="wp-image-124"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph {"style":{"typography":{"lineHeight":"1.5"}}} -->
<p style="line-height:1.5">Now see these last three fields in the image above. We need to fill the <em>Client ID</em> and <em>Client Secret</em> fields with the <em>Certificates &amp; secrets</em>, registered in the Azure.<br>The <strong>Client Authentication</strong> field, choose the <em>Client secret sent as post</em>. <br>The <strong>Client ID</strong> field, go to the Azure, <em>App registration</em>, select the application. In the application <em>Overview</em>, look at the <strong>Application (Client) ID</strong> and copy this value. Back to the keycloak, and paste the information in the field.<br>The <strong>Client secret</strong> field, do you remember that we need to save some information in the <em>Client secret</em> section in this post? So we need the client secret <em>Value</em>, get this value and paste into the field.<br><br>Once this is done, the settings should look like the image below:</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":126,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/keycloak_identity_provider_oidc_config_save.png?w=714" alt="" class="wp-image-126"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><br>Now save it and go to the top page, and copy the <strong>Redirect URI.</strong> This information we need to use in the azure.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":128,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/keycloak_identity_provider_redirect_uri.png?w=740" alt="" class="wp-image-128"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>After those configurations, back to azure again to the last configurations.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Configure the <em>Authentication</em></h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Now back to the Azure, and go to <strong>Azure Active Directory</strong> &gt; <strong>App registration</strong> &gt; application &gt; <strong>Authentication</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":131,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/menu_authentication-1.png?w=239" alt="" class="wp-image-131"/></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>The <em>Platform configurations</em> will appear, click on the <strong>Add a platform</strong> button as the image below</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":133,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/azure_ad_app_authentication.png?w=966" alt="" class="wp-image-133"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>When we click, a window will appear on the right side. Select the <strong>Web</strong> option.<br></p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":135,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/azure_ad_app_add_platform_web.png?w=1024" alt="" class="wp-image-135"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Now paste the <strong>Redirect URI</strong>, copied in the last section, in the <strong>Redirect URIs</strong> and click on <strong>Configure</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":138,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/image-2.png?w=550" alt="" class="wp-image-138"/></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Once this is done, the configuration should appear as in the image below.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":139,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/redirect_uri_configured.png?w=964" alt="" class="wp-image-139"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Now we can test our application. <br><br>So back to the keycloak, select the realm and go to menu <strong>Clients</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":141,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/keycloak_clients_test_auth.png?w=1024" alt="" class="wp-image-141"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Click in the account's <strong>Base URL</strong>. We will be redirected to the sign-in page as the imagem below.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":143,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/image-3.png?w=1024" alt="" class="wp-image-143"/><figcaption>In this example, I'm using version 12.0.4.RELEASE. Perhaps your page will be different.</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Click in <strong>Sign In</strong> button, and We will be redirected to the sign-in form. See the <em>Or sign in with</em> button. This button is our previously configured <em>Identity provider</em>. </p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":145,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/login_azure.png?w=485" alt="" class="wp-image-145"/></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Click on this button, and we will be redirected to the Microsoft Sign-in form. Put your azure user (e-mail/username) and after your password.</p>
<!-- /wp:paragraph -->

<!-- wp:columns -->
<div class="wp-block-columns"><!-- wp:column {"width":"100%"} -->
<div class="wp-block-column" style="flex-basis:100%"><!-- wp:group -->
<div class="wp-block-group"><!-- wp:jetpack/tiled-gallery {"columnWidths":[["47.45001","52.54999"]],"ids":[147,150]} -->
<div class="wp-block-jetpack-tiled-gallery aligncenter is-style-rectangular"><div class="tiled-gallery__gallery"><div class="tiled-gallery__row"><div class="tiled-gallery__col" style="flex-basis:47.45001%"><figure class="tiled-gallery__item"><img alt="" data-height="413" data-id="147" data-link="https://andremoriya.wordpress.com/image-4/" data-url="https://andremoriya.files.wordpress.com/2021/04/image-4.png" data-width="456" src="https://andremoriya.files.wordpress.com/2021/04/image-4.png" data-amp-layout="responsive"/></figure></div><div class="tiled-gallery__col" style="flex-basis:52.54999%"><figure class="tiled-gallery__item"><img alt="" data-height="363" data-id="150" data-link="https://andremoriya.wordpress.com/stay_signed_in/" data-url="https://andremoriya.files.wordpress.com/2021/04/stay_signed_in.png" data-width="444" src="https://andremoriya.files.wordpress.com/2021/04/stay_signed_in.png" data-amp-layout="responsive"/></figure></div></div></div></div>
<!-- /wp:jetpack/tiled-gallery -->

<!-- wp:paragraph -->
<p>If everything went well, this page should appear.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":152,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/image-5.png?w=654" alt="" class="wp-image-152"/></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Update some information and click on <em>Submit</em>, you will be redirected to this page:</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":154,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://andremoriya.files.wordpress.com/2021/04/image-6.png?w=1024" alt="" class="wp-image-154"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Well that's it. I hope this post can help you.<br><br>Send your feedback/suggestion and/or if you need some help, please contact me.<br><br>Thank you very much and see you soon.</p>
<!-- /wp:paragraph -->