oidc with keycloak

[manustars]

Hi everyone, I've implemented Keycloak login and I need to allow only users in a specific Keycloak group to log in. With this setup, all users can log in to MC

    {
      "settings": {
        "port": 8080,
        "aliasPort": 443,
        "agentPort": 4433,
        "redirPort": 81,
        "LANonly": false,
        "wanonly": false,
        "allowLoginToken": true,
        "allowNewAccounts": false,
        "cert": "domain.com"
      },
      "domains": {
        "": {
          "title": "MeshCentral",
          "title2": "Login via Keycloak",
          "userNameIsEmail": true,
          "certUrl": "https://domain.com",
          "authStrategies": {
            "oidc": {
              "issuer": "https://domanin.com/auth/realms/master",
              "client": {
                "client_id": "meshcentral",
                "client_secret": "**********",
                "redirect_uri": "https://domain.com/auth-oidc-callback"
              },
              "groupsClaim": "groups",
              "requiredGroups": ["meshcentral-users"],
              "userNameClaim": "preferred_username",
              "userEmailClaim": "email",
              "newAccounts": false,
              "required": true
            }
          }
        }
      }
    }

but with this one I always get access denied

    {
      "settings": {
        "port": 8080,
        "aliasPort": 443,
        "agentPort": 4433,
        "redirPort": 81,
        "LANonly": false,
        "wanonly": false,
        "allowLoginToken": true,
        "allowNewAccounts": false,
        "cert": "domain.com"
      },
      "domains": {
        "": {
          "title": "MeshCentral",
          "title2": "Login via Keycloak",
          "userNameIsEmail": true,
          "certUrl": "https://domain.com",
          "authStrategies": {
            "oidc": {
              "issuer": "https://domain.com/auth/realms/master",
              "client": {
                "client_id": "meshcentral",
                "client_secret": "************",
                "redirect_uri": "https://domain.com/auth-oidc-callback"
              },
              "groups": {
                "required": ["meshcentral-user"],
                "siteadmin": ["meshcentral-admin"],
                "revokeAdmin": false
              },
              "userNameClaim": "preferred_username",
              "userEmailClaim": "email",
              "newAccounts": false,
              "required": true
            }
          }
        }
      }
    }

[si458]

your 2nd config is correct so im not sure why its denying you login?
one thing to try is enabling the authlog and check the logs when you login and see what it says
it will output helpful info about each stage etc and what it retieves etc
"authLog": "/full/path/to/authlog.txt" <- add under settings in config.json

[si458]

what option/config are you using to sync the groups in your config.json?
you shouldnt HAVE to sync the groups to get it to work, it just makes it easier for you to manage
so you dont have to create groups in meshcentral and assign users too for permissions etc
the groups get created automatically and users assigned automatically too

[manustars]

i add the sync field in config for user and admin.
I haven't created any groups, but they've synchronized through the configuration. The only problem I'm having is when I log in a user who doesn't have permissions, it stays in the cache, and I have to clear the cookies to log back in. I'd need to implement something to do a sort of "logout" even when access is denied.

this current config

    {
      "settings": {
        "port": 8080,
        "aliasPort": 443,
        "agentPort": 4433,
        "redirPort": 81,
        "LANonly": false,
        "wanonly": false,
        "allowLoginToken": true,
        "authLog": "/opt/meshcentral/meshcentral-data/authlog.txt",
        "allowNewAccounts": false,
        "cert": "remote.marselli.org"
      },
      "domains": {
        "": {
          "title": "MeshCentral",
          "title2": "Login via Keycloak",
          "userNameIsEmail": true,
          "certUrl": "https://domain.org",
          "authStrategies": {
            "oidc": {
              "issuer": "https://domain.com/auth/realms/master",
              "client": {
                "client_id": "meshcentral",
                "client_secret": "**************",
                "redirect_uri": "https://domain.org/auth-oidc-callback"
              },
              "groups": {
                "required": ["meshcentral-user", "meshcentral-admin"],
                "siteadmin": ["meshcentral-admin"],
                "revokeAdmin": false,
                "sync": {
                  "enabled": true,
                  "filter": ["meshcentral-user", "meshcentral-admin"]
                }
              },
              "userNameClaim": "preferred_username",
              "userEmailClaim": "email",
              "newAccounts": false,
              "required": true
            }
          }
        }
      }
    }
``

[si458]

amazingly i spend the WHOLE of yesterday trying to get keycloak setup, it was a real pain in the ass! (authentik is much easier)
eventually got it setup and working with meshcentral
but i had to use the realm-roles as the groups for my users and create the groups scope as a client scopes
not sure if this is how you have it setup?

[si458]

also how are you creating/adding new accounts in meshcentral?
you have newAccounts: false set so no new users can login because they dont exist in meshcentral and cant be created?
also userNameClaim, userEmailClaim, required dont exist in the schema file? so why do you have them?

[manustars]

I don't actually have an account in meshcentral, but I simply synced the keycloak groups and use the keycloak accounts. For those 2 settings, they are tests that I can ignore.You're right about configuring Keycloak, it's a bit complex but it works very well. Let's say I was forced to use it since I have other products that use Outh and Soo set to Keycloak.

[manustars]

I'll continue the post for simplicity's sake. I added a group to Keycloak and updated the configmap (also recreating the pod) to sync with MC, but I can see the first two (admin and user) but not the last one. I have a feeling it's a display issue in the browser. Is it possible to check on the MC side if that group has actually been added?
"groups": { "required": ["meshcentral-user", "meshcentral-admin", "meshcentral-gsd"], "siteadmin": ["meshcentral-admin"], "revokeAdmin": false, "sync": { "enabled": true, "filter": ["meshcentral-user", "meshcentral-admin", "meshcentral-gsd"] }