Keycloak Single Sign-On (Deployment Plan)¶

# OIDC client configuration (if wellKnownURL is configured in this item, the KeyCloakPassSet configuration item automatically becomes invalid)
OIDCClientSet:
  # OIDC Endpoints configuration URL, i.e., the complete `https://xxx.xxx.com/xx/.well-known/openid-configuration` URL.
  wellKnowURL:
  # Client ID provided by the authentication service
  clientId:
  # Client's Secret key
  clientSecret:
  # Authentication method, currently only supports authorization_code
  grantType: authorization_code
  verify: false
  # Data access scope
  scope: "openid profile email address"
  # Callback URL after successful authentication by the authentication server
  innerUrl: "{}://{}/oidc/callback"
  # URL where the DF system redirects the user after obtaining user information from the authentication service
  frontUrl: "{}://{}/tomiddlepage?uuid={}"
  # Mapping configuration between account information obtained from the authentication service and DF system accounts, required fields include: username, email, exterId
  mapping:
    # Username of the login account from the authentication service, required; if not present, it defaults to email
    username: preferred_username
    # Email of the login account from the authentication service, required
    email: email
    # Phone number field name of the login account from the authentication service, optional
    mobile: phone_number
    # Unique identifier of the login account from the authentication service, required
    exterId: sub

        # =========OIDC Protocol Redirection Configuration Start=========
        # Request directly redirected to Inner API endpoint ==========Start=========
        # This address is used for third-party login access; adjust as needed, but do not change the proxy_pass route address
        location /oidc/login {
            proxy_connect_timeout 5;
            proxy_send_timeout 5;
            proxy_read_timeout 300;
            proxy_http_version 1.1;
            proxy_set_header Connection "keep-alive";
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Headers X-Requested-With;
            add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
            proxy_pass http://inner.forethought-core:5000/api/v1/inner/oidc/login;
        }

        # This address is used for callback after successful OIDC protocol authentication by third-party services; this address should be synchronized with the innerUrl configuration under OIDCClientSet in [3.2.1]; do not change the proxy_pass value
        location /oidc/callback {
            proxy_connect_timeout 5;
            proxy_send_timeout 5;
            proxy_read_timeout 300;
            proxy_http_version 1.1;
            proxy_set_header Connection "keep-alive";
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Headers X-Requested-With;
            add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
            proxy_pass http://inner.forethought-core:5000/api/v1/inner/oidc/callback;
       }
       # =========OIDC Protocol Redirection Configuration End=========

window.DEPLOYCONFIG = {

    ......

    paasCustomLoginInfo:[
        {url:"http://Guance deployment domain/oidc/login", label:"Keycloak Login"}
    ],
    paasCustomLoginUrl: "https://<customer-provided logout URL>?redirect_url=https://Guance Web login domain/oidc/login"


    ......

};