Keycloak Single Sign-On (Deployment Plan)¶

# OIDC client configuration (when wellKnowURL is configured in this set, the KeyCloakPassSet configuration item becomes invalid)
OIDCClientSet:
  # OIDC Endpoints configuration URL, i.e., the full `https://xxx.xxx.com/xx/.well-known/openid-configuration` URL.
  wellKnowURL:
  # Client ID provided by the authentication service
  clientId:
  # Client Secret key
  clientSecret:
  # Authentication method, currently only supports authorization_code
  grantType: authorization_code
  verify: false
  # Data access scope
  scope: "openid profile email address"
  # Callback URL after successful authentication by the authentication server
  innerUrl: "{}://{}/oidc/callback"
  # After the authentication server successfully authenticates and calls back the DF system, the DF system obtains user information and redirects to the front-end intermediate page
  frontUrl: "{}://{}/tomiddlepage?uuid={}"
  # Mapping configuration between account information obtained from the authentication service and DF system accounts. Required fields: username, email, exterId
  mapping:
    # Username of the login account in the authentication service. Required. If the value does not exist, use email.
    username: preferred_username
    # Email of the login account in the authentication service. Required.
    email: email
    # Phone number field name of the login account in the authentication service. Optional.
    mobile: phone_number
    # Unique identifier of the login account in the authentication service. Required.
    exterId: sub

        # =========OIDC protocol redirect configuration start=========
        # Request directly redirects to the Inner API endpoint ========= start =========
        # This URL is used for third-party login access; it can be changed as needed, but the route corresponding to proxy_pass must not be modified
        location /oidc/login {
            proxy_connect_timeout 5;
            proxy_send_timeout 5;
            proxy_read_timeout 300;
            proxy_http_version 1.1;
            proxy_set_header Connection "keep-alive";
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Headers X-Requested-With;
            add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
            proxy_pass http://inner.forethought-core:5000/api/v1/inner/oidc/login;
        }

        # This URL is used for the callback from the third-party service after OIDC authentication succeeds; it is directly related to the innerUrl configuration under the OIDCClientSet configuration item in [3.2.1]; when this URL changes, it should be updated synchronously with innerUrl; the proxy_pass value must not be modified
        location /oidc/callback {
            proxy_connect_timeout 5;
            proxy_send_timeout 5;
            proxy_read_timeout 300;
            proxy_http_version 1.1;
            proxy_set_header Connection "keep-alive";
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Headers X-Requested-With;
            add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
            proxy_pass http://inner.forethought-core:5000/api/v1/inner/oidc/callback;
       }
       # =========OIDC protocol redirect configuration end=========

window.DEPLOYCONFIG = {

    ......

    paasCustomLoginInfo:[
        {url:"http://Guancedeployment domain/oidc/login",label:"Keycloak Login"}
    ],
    paasCustomLoginUrl: "https://<客户提供的注销登录地址>?redirect_url=https://GuanceWeb login domain/oidc/login"


    ......

};