How to make Django tries multiple realms in Keycloak using openid connect? - django

Question

Synopsis
We have a web app that allows internal users and external users to login, we would like to split the 2 groups of users in Keycloak with different realms, for instance, internal realm and external realm. Our ideal authentication method is OpenID Connect.
Problem
Most Django OIDC libraries allows to specify one OIDC client configuration in Django settings. However given how OIDC works one client configuration only works with one realm, because a client is configured inside a realm.
I have come across this library django-keycloak which seems to be able to configure client configurations in a database and I need to implement my own middleware to dynamically route the request to a corresponding realm, see multi-tenancy section.
Unfortunately this library has not been updated for 2 years and seems not maintained anymore.
Question
Is there an up-to-date library that has similar functionality in django-keycloak? (I will raise an issue in the repo to enquire the project status)
Apart from the multi-client configuration approach, is there a better alternative?

Answer 1

I do not know about django, but from the Keycloak side what you can do is to configure the external realm as an identity provider for the internal realm. You can read about identity brokering here.
For that go to the Admin Console and:
select your Internal Realm, and click on Identity Providers
On the right side of the page select Keycloak OpenID Connect from the Add provider ... dropdown menu. It will popup the Add Identity Provider form, from there set:
the alias
the Authorization URL, Token URL, Logout URL, User Info URL and Issuer to the correspondent endpoints that can be found on the external realm .well-known endpoint (i.e., <KEYCLOAK_IP>/auth/realms/<External Realm Name>/.well-known/openid-configuration)
For the Client Authentication you can select Client secret send as post
For the Client ID and Client Secret first create a new client in your external realm and use its Client ID and Client Secret here. This client:
can have Access Type confidential
Standard Flow Enabled : ON
Valid Redirect URIs set it to your Keycloak IP followed by "*", for instance <KEYCLOAK_IP>*
Web Origins : +
Save
Bear in mind that some of those configurations might have to be adapted to your own needs.
Now if everything was set correctly, at the keycloak internal realm login page will show up a new button that the users stored on the external realm can click on to authenticate against the external realm.
Now you configure your app to lend at the Internal Realm Login page, the users from your internal realm authenticate immediately there, the users from the external realm click on the new button to explicitly authenticate against the external realm.
This setup is more or less like the use case that a user wants to login into your app but using his/her social media account.