Die BPC Version 4.1 wird nicht mehr gewartet.

Sollten Sie diese BPC Version nutzen, empfehlen wir Ihnen eine Migration auf eine aktuelle Version. Die Dokumentation zur neusten BPC Version finden Sie hier. Sollten Sie Fragen haben, wenden Sie sich bitte an unseren Support.

Connecting and Setting Up Keycloak

Keycloak is an identity provider that can be used for user authentication. If the identity providers already supported are insufficient due to functionality limitations or security concerns, then Keycloak is recommended. Even though the setup process is a bit more involved.

Prerequisites

You have installed Keycloak according to the official instructions (https://www.keycloak.org/documentation) and have administrative access to Keycloak.

You should always use the latest version of Keycloak whenever possible to avoid security risks.

Keycloak Configuration

The Leader realm in Keycloak should only be used for managing administrators. Therefore, please create another realm or use an existing realm that you may already be using for other applications.

Create a client

In order for the BPC to communicate with Keycloak, a so-called client must be created.

  1. Make sure you have selected the correct realm.

  2. Select "Clients" on the left-hand side

  3. Create a new client using "Create client"

  4. Select "OpenID Connect" as the "Client type"

  5. Set the Client ID to "BPC-core"

  6. Enable "Client authentication". In older versions of Keycloak, this corresponds to the "confidential" access type.

  7. Enter the URL of your BPC under "Valid redirect URIs." For example, "https://BPC.example.com/"

  8. Save the client

  9. In the "Passwords" (or "Credentials") tab, you can view (and also change) the client secret. You will need this later to connect the BPC

Create BPC Roles

  1. Select "Realm Roles" on the left side

  2. Use "Create role" to create the "bpcadmin" role.

Create or Assign a BPC Administrator

For a user to be a BPC administrator, they must have the "bpcadmin" role.

  1. Select "Users" on the left-hand side

  2. Use "Add User" or select an existing user

  3. Assign the "bpcadmin" role to the user

BPC Configuration

In BPC, Keycloak must be created as an identity provider under Backend Connections and then specified as the identity provider to be used in the Core Services settings.

When BPC is first started, backend Connections are automatically created that can be used for Keycloak. These contain a suitable placeholder configuration and are named Keycloak and OIDC. See also Identity Provider Keycloak vs. OIDC

Identity Provider Keycloak vs. OIDC

You have the option to connect Keycloak in two different ways (IdentityProvider oidc or keycloak). In both variants, the actual authentication takes place via the OpenID Connect protocol. If you select “keycloak,” a Keycloak admin user must also be configured. In this case, users can be managed directly from within the BPC. In the “ oidc ” variant, user administration takes place exclusively in Keycloak.

Create an “Identity Provider” Backend Connection

  1. BPC Settings → Backend Connections → Components

  2. Click the “+” button at the bottom to create a new component; select “identity_provider” as the type

Setting (Key) Group Value Description

Module_Name
(module_name)

module

e.g., "company-keycloak"

Assign a descriptive and unique name

IdentityProvider
(identityProvider)

config

keycloak or oidc

Set Keycloak or OIDC as the IdP for the backend connection. See also Identity Provider Keycloak vs. OIDC

IdentityProvider_URL
(identityProvider.url)

config

https://localhost:8080/auth/realms/BPC/.well-known/openid-configuration

The OpenID endpoint of the Keycloak server

IdentityProvider_Configuration
(identityProvider_configuration)

config

 
{
  "client_id": "bpc-core",
  "scope": "openid profile email address phone bpc-rollen roles",
  "claim_name_roles": "bpc_client_roles,bpc_realm_roles",
  "client_secret": "8687ab26-830f-47ed-8ed1-6e62192ccd9c",
  "post_logout_redirect_uri": "http://localhost:8181",
  "post_authentication_redirect_uri": "http://localhost:8181/",
  "keycloak": {
    "realm": "bpc",
    "adminclient_realm": "master",
    "adminclient_client_id": "admin-cli",
    "adminclient_server_url": "http://localhost:8080/auth",
    "adminclient_username": "admin",
    "adminclient_password": "******"
  }
}

The configuration for Keycloak access. The section below "keycloak" is only necessary if "keycloak" is selected under IdentityProvider (see also Identity Provider Keycloak vs. OIDC). The URLs here must be adjusted to match the BPC and Keycloak. Under client_secret, enter the client secret retrieved from Create a client. Under adminclient_username and adminclient_password, you must enter the login credentials of a Keycloak administrator so that the BPC can retrieve user data via the Keycloak API.

Usage

See Creating, Configuring, and Using an Identity Provider.

Keywords:
Press Esc to exit full screen
Modal image placeholder
Press Esc to exit full screen