Cbox ID
Keycloak
Keycloak
Single sign-on (OpenID Connect)
In the portal, choose Keycloak under Enterprise SSO and Start with Keycloak. Then, in Keycloak:
- In the Keycloak admin console, select your realm — not master — then Clients → Create client.
- Leave Client type as OpenID Connect and enter a Client ID.
- Turn Client authentication on and keep Standard flow enabled — a public client has no secret to give us.
- Add the redirect URI below to Valid Redirect URIs. Avoid wildcards.
- Copy the client secret from the Credentials tab; the issuer is https://<host>/realms/<realm>.
The values the portal shows
| Keycloak field | Value |
|---|---|
| Valid Redirect URIs | The portal's redirect URI (https://…/sso/oidc/…/callback) |
| Client authentication (Capability config) | On |
| Scopes | openid email profile |
What to bring back
Enter https://<host>/realms/<realm>, Client ID, Client Secret (Credentials tab) in the portal.
Keycloak's own guide: https://www.keycloak.org/docs/latest/server_admin/index.html#_oidc_clients.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.