Differences

This shows you the differences between two versions of the page.

--- en:2.0:single_sign_on:oidc_keycloak [2025/05/11 02:09] – created kainhofer
+++ en:2.0:single_sign_on:oidc_keycloak [2026/09/09 20:46] (current) – [Prerequisites] kainhofer
@@ Line 8: / Line 8: @@
 Throughout the document we will assume you have both Admidio and Keycloak already set up properly at https://admidio.local/ and https://keycloak.local/. Please modify these URLs to your actual installation.
-As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to Keycloak. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_an_oidc_id_provider]]
+As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to any particular client. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_an_oidc_id_provider|folow this guide]]:
 {{ :en:2.0:sso:sso_oidc_01-05_setup_admidio_preferences.png?direct&600 |}}
-Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**.
-The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata.
+Basically, one needs to enable OpenID Connect (OIDC). The Issuer URL should in most cases be left blank, which means Admidio's public URL will be used as issuer URL.
+The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the automatic discovery URL, and the individual settings for clients that do not support auto-configuration via metadata.
 ===== Quick Overview =====
@@ Line 99: / Line 102: @@
 After choosing OpenID login and logging in with a user from Admidio, you should also be logged in into Keycloak.
 {{ :en:2.0:sso:sso_oidc_keycloak_08_admidio_loginform.png?direct&400 |}}
-If the account already exists (e.g. because you are in a hybrid setup with multiple identity providers, e.g. SAML and OpenID through Admidio), then Keycloak will ask for permission to add the SAML login to the existing account. The user must additionally log in to the existing account to prevent security issues:
-{{ :en:2.0:sso:sso_saml_keycloak_09_login_accountexists.png?direct&400 |}}{{ :en:2.0:sso:sso_saml_keycloak_10_login_link_login.png?direct&400 |}}
 Your user should now be logged in and have the proper permissions/roles
 {{ :en:2.0:sso:sso_oidc_keycloak_10_linkedaccounts.png?direct&600 |}}
+===== Multiple SSO providers for the same account =====
+If the account already exists (e.g. because you are in a hybrid setup with multiple identity providers, e.g. SAML and OpenID through Admidio), then Keycloak will ask for permission to add the SAML login to the existing account. The user must additionally log in to the existing account to prevent security issues:
+{{:en:2.0:sso:sso_saml_keycloak_09_login_accountexists.png?direct&400|}}{{:en:2.0:sso:sso_saml_keycloak_10_login_link_login.png?direct&400|}}
+{{ :en:2.0:sso:sso_oidc_keycloak_10_linkedaccounts.png?direct&600 |}}