Keycloak SSO

Follow the sections in this guide to set up Keycloak SSO.

priority_high

Important

Security requirements for your production environment:

  • DELETE the admin default account shipped by OM in case you had Basic Authentication enabled before configuring the authentication with Keycloak SSO.
  • UPDATE the Private / Public keys used for the JWT Tokens. The keys we provide by default are aimed only for quickstart and testing purposes. They should NEVER be used in a production installation.
  • You need an administrator account. If you don't have, see Creating the first administrator.
  • Go to the URL for the Admin Console. For example, for localhost, use this URL: http://localhost:8080/admin/
login-page
  • Enter the username and password you created.
  • The Keycloak use Realms as the primary form of organization, we can't use the realm "master" for new clients (apps), only for administration, so change for your specific realm or create a new.
  • In this example we are used an existing one called "Data-sec".
change-realm
  • Click on Clients in the menu.
  • Click on Create button.
  • Enter the Client ID and Protocol as the image.
  • Click on Save button.
add-client
  • Change "Acess Type" value from "public" to "confidential".
  • Change "implicit flow" and "service accounts" to enabled.
edit-settings-client
  • At the bottom of the same settings page, change the configurations to the openmetadata address.
  • The image below shows different possibilities, such as running locally or with a custom domain.
edit-settings-url.png
  • Click on Save button.

Note

Note: Scopes openid, email & profile are required to fetch the user details so you will have to add these scopes in your client.

Note

Configuring a service account in Keycloak is optional if you configure the ingestion-bot with the JWT Token, you can follow the documentation of Enable JWT Tokens.

  • Navigate to the Credentials tab.
  • You will find your Client Secret related to the Client id "open-metadata"
client-credentials
  • Navigate to the Service Account Roles tab.
  • You will find your service account id related to the Client id "open-metadata"
client-service-account.png

After the applying these steps, the users in your realm are able to login in the openmetadata, as a suggestion create a user called "admin-user". Now you can update the configuration of your deployment:

After everything has been set up, you will need to configure your workflows if you are running them via the metadata CLI or with any custom scheduler.

Note that KeyCloak SSO is a layer on top of Custom OIDC.

When setting up the YAML config for the connector, update the workflowConfig as follows:

workflowConfig:
  openMetadataServerConfig:
    hostPort: 'http://localhost:8585/api'
    authProvider: custom-oidc
    securityConfig:
      clientId: '{your_client_id}'
      secretKey: '{your_client_secret}'
      tokenEndpoint: '{your_token_endpoint}' # e.g. http://localhost:8081/realms/data-sec/protocol/openid-connect/token

Note

A dockerized demo for showing how this SSO works with OpenMetadata can be found [here](https://github.com/open-metadata/openmetadata-demo/tree/main/keycloak-sso).

Still have questions?

You can take a look at our Q&A or reach out to us in Slack

Was this page helpful?

editSuggest edits