Security and Team Management
SSO with Keycloak
Configure Keycloak as an OIDC SSO provider for dFlow.
Use this walkthrough to fill out Account → Single Sign-On → Add OIDC for Keycloak.
1. Create a client in Keycloak
- Open your Keycloak Admin Console.
- Select the realm your users belong to.
- Go to Clients → Create client.
- Set:
| Field | Value |
|---|---|
| Client type | OpenID Connect |
| Client ID | For example dflow-sso (this is the OAuth client id, not the dFlow Provider ID) |
| Client authentication | On (confidential client) |
| Authentication flow | Standard flow (authorisation code). Enable Direct access grants only if you need them for other tools; dFlow does not require them. |
-
On Login settings, set Valid redirect URIs to:
{your-dflow-url}/api/auth/sso/callback/<provider-id>Pick the Provider ID in dFlow first (for example
acme-keycloak) so the URI matches exactly. -
Set Web origins to your dFlow origin, or
+if your Keycloak version accepts that shortcut for valid redirect origins. -
Open Credentials and copy the Client secret.
2. Issuer URL
Keycloak issuer URLs follow:
https://<host>/realms/<realm>Example: https://auth.acme.com/realms/acme
Confirm discovery works by opening:
https://<host>/realms/<realm>/.well-known/openid-configuration3. Fill in the dFlow modal
| Field | Value |
|---|---|
| Provider ID | Same suffix as the redirect URI (for example acme-keycloak) |
| Email domains | Domains your Keycloak users sign in with |
| Issuer URL | https://<host>/realms/<realm> |
| Client ID | Keycloak client id from step 1 |
| Client secret | from Keycloak Credentials |
| Scopes | openid email profile |
| Token auth method | client_secret_basic (switch to client_secret_post only if your realm requires it) |
| Use PKCE | On |
| Skip discovery | Off |
Leave optional endpoints blank when discovery is reachable from dFlow.
4. Save and test
- Click Add provider.
- Sign out of dFlow.
- Enter an email on a registered domain.
- Complete Keycloak sign-in and confirm you return to dFlow signed in.
Tips
- Users need an email attribute in Keycloak. Map it under Realm settings → User profile or client mappers if email is missing from tokens.
- If Keycloak is on a private hostname that differs from the public issuer, add both origins under Trusted origins in dFlow when discovery and login hosts diverge.
- For SAML realms or SAML clients, use Add SAML instead. See SSO with any OIDC or SAML provider.