Keycloak Single Sign-On (Deployment Plan)¶

# OIDC client configuration (when wellKnowURL is configured in this section, the KeyCloakPassSet configuration automatically becomes invalid)
OIDCClientSet:
  # OIDC Endpoints configuration URL, that is, the complete `https://xxx.xxx.com/xx/.well-known/openid-configuration` URL.
  wellKnowURL:
  # Client ID provided by the authentication service
  clientId:
  # Client secret key
  clientSecret:
  # Authentication method; currently only authorization_code is supported
  grantType: authorization_code
  verify: false
  # Data access scope
  scope: "openid profile email address"
  # Callback URL after successful authentication on the authentication server
  innerUrl: "{}://{}/oidc/callback"
  # The URL to which the DF system redirects to the front-end middle page after the authentication service successfully authenticates and calls back to the DF system with user information
  frontUrl: "{}://{}/tomiddlepage?uuid={}"
  # Mapping configuration between the account information obtained from the authentication service and DF system accounts. Required fields: username, email, exterId
  mapping:
    # The username of the login account in the authentication service. Required. If this value does not exist, email is used.
    username: preferred_username
    # The email of the login account in the authentication service. Required.
    email: email
    # The phone number field name of the login account in the authentication service. Optional.
    mobile: phone_number
    # The unique identifier of the login account in the authentication service. Required.
    exterId: sub

        # =========Start of OIDC protocol redirect configuration=========
        # Interface that directly redirects requests to the Inner API =========Start=========
        # This address is the access URL for third-party login. You can change it as needed, but the route address corresponding to proxy_pass cannot be changed.
        location /oidc/login {
            proxy_connect_timeout 5;
            proxy_send_timeout 5;
            proxy_read_timeout 300;
            proxy_http_version 1.1;
            proxy_set_header Connection "keep-alive";
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Headers X-Requested-With;
            add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
            proxy_pass http://inner.forethought-core:5000/api/v1/inner/oidc/login;
        }

        # This address is used for the callback to this service after a third-party service passes authentication through the OIDC protocol. It is directly associated with the innerUrl configuration under the OIDCClientSet configuration in [3.2.1]. When this address changes, it must be changed in sync with innerUrl. The value corresponding to proxy_pass cannot be changed.
        location /oidc/callback {
            proxy_connect_timeout 5;
            proxy_send_timeout 5;
            proxy_read_timeout 300;
            proxy_http_version 1.1;
            proxy_set_header Connection "keep-alive";
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Headers X-Requested-With;
            add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
            proxy_pass http://inner.forethought-core:5000/api/v1/inner/oidc/callback;
       }
       # =========End of OIDC protocol redirect configuration=========

window.DEPLOYCONFIG = {

    ......

    paasCustomLoginInfo:[
        {url:"http://Guance-deployment-domain/oidc/login",label:"Keycloak Login"}
    ],
    paasCustomLoginUrl: "https://<logout-address-provided-by-customer>?redirect_url=https://Guance-web-login-domain-address/oidc/login"


    ......

};