Create a client in Keycloak.
Provide a client ID:
Select the client protocol as openid-connect
Select the client access type as confidential
Standard flow implemented: ON
Valid Redirect URL:
The following image shows the minimal configurations needed to setup Keycloak as an Identity Provider to Rocket.Chat.
After saving the changes a new credentials tab will be created for the client. This credentials tab will provide the client secrets which will be used when configuring the Rocket.Chat
Login to Rocket.Chat with an administrator account and navigate to OAuth page.
Click the Add custom OAuth button and provide the following configurations
The URL paths provided in the below configurations can be also obtained by navigating to the Realm setting and clicking the endpoints link in the
General Tab. While configuring the below settings replace the
realm_name with the appropriate realm name. The default realm provided by Keycloak is
Token sent via: Header
Identity Token Sent Via: Same As "Token Sent Via"
Param Name for access token:
Id: This is the id of the Rocket.Chat client created in the keycloak
Secret: Secret key provided in the credentials tab when creating the Rocket.Chat client
Login with Keycloak
Leave the rest of the configurations as default.
Now logout from Rocket.Chat to view the keycloak based login option visible in the login page.
This section documents how client-specific roles of keycloak managed user can be mapped to Rocket.Chat roles. This does not work for federated users (e.g. LDAP managed users).
For this example, we map the
livechat-manager role, as documented in Permissions.
First we add the required roles to the client
then we have to add a mapper entry, that maps our client roles to OpenId, passing the value to Rocket.Chat
Now in order to grant the Rocket.Chat role to a user, we have to modify the users Role Mappings.
![User Role Mapping][User Role Mapping]
The roles are only synced on first login, and not being refreshed on each login. Please see the bug report for current state.
[User Role Mapping]: user_role_mapping.png