# OIDC / Keycloak
**URL:** https://community.zammad.org/t/oidc-keycloak/1983
**Category:** Completed Features
**Tags:** zammad-32, done
**Created:** [January 23, 2019, 12:36pm UTC](https://community.zammad.org/t/oidc-keycloak/1983 "2019-01-23T12:36:23Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@mattronix](https://community.zammad.org/u/mattronix)
#### Post date: [January 23, 2019, 12:36pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/1 "2019-01-23T12:36:23Z")
Hello All,
I would like to request or suggest OIDC provider for authentication or the support of SAML, this would allow authentication with Keycloak or Enterprise SSO such as ADFS, One-login or Okta without having to pay for a really expensive OAUTH2 license.
Thank you for reading! 🙂
---
### Author:  [@fgaillard](https://community.zammad.org/u/fgaillard)
#### Post date: [February 4, 2019, 12:35pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/2 "2019-02-04T12:35:33Z")
We got something working with keycloak and OIDC, by just overriding the file : oauth2\_database.rb
Mostly you need to provide a link to the “userinfo” endpoint of keycloak,
```auto
class Oauth2Database < OmniAuth::Strategies::OAuth2
option :name, 'oauth2'
def initialize(app, *args, &block)
# database lookup
config = Setting.get('auth_oauth2_credentials') || {}
args[0] = config['app_id']
args[1] = config['app_secret']
args[2][:client_options] = args[2][:client_options].merge(config.symbolize_keys)
super
end
def callback_url
full_host + script_name + callback_path
end
uid { raw_info['sub'] }
info do
{
email: raw_info['email'],
username: raw_info['name'],
login: raw_info['preferred_username'],
first_name: raw_info['given_name'],
last_name: raw_info['family_name'],
}
end
extra do
{
'raw_info' => raw_info
}
end
def raw_info
@raw_info ||= begin
#
# todo build the URI from the settings
#
uri = URI.parse("https://keycloak.mydomain.org/auth/realms/REALMNAME/protocol/openid-connect/userinfo")
request = Net::HTTP::Get.new(uri)
request['Authorization'] = 'Bearer ' + access_token.token
response = Net::HTTP.start(uri.host, uri.port, :use_ssl => uri.scheme == 'https') do |http|
http.request(request)
end
Rails.logger.info "RESPONSE = #{response.body}"
JSON.parse(response.body)
end
end
end
```
Hope it can help you.
---
### Author:  [@MrGeneration](https://community.zammad.org/u/MrGeneration)
#### Post date: [February 4, 2019, 4:42pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/3 "2019-02-04T16:42:16Z")
Please note that changing Zammad files is not update-safe and produces further needed work on every update.
---
### Author:  [@mattronix](https://community.zammad.org/u/mattronix)
#### Post date: [February 4, 2019, 5:19pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/4 "2019-02-04T17:19:21Z")
Any way you could OIDC or SAML support?
Most enterprises use either OIDC or SAML these day ☹
Thanks!!
---
### Author:  [@mattronix](https://community.zammad.org/u/mattronix)
#### Post date: [February 4, 2019, 5:20pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/5 "2019-02-04T17:20:17Z")
Oah neat 🙂 will need to test it
---
### Author:  [@fgaillard](https://community.zammad.org/u/fgaillard)
#### Post date: [February 5, 2019, 2:39pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/6 "2019-02-05T14:39:05Z")
Yes, sure. We use Ansible to automatically deploy Zammad and override a few files.
And yes it has to be tested and validated for each upgrades.
---
### Author:  [@mattronix](https://community.zammad.org/u/mattronix)
#### Post date: [February 5, 2019, 10:54pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/7 "2019-02-05T22:54:48Z")
Silly question but what is the full path to the file?
---
### Author:  [@mattronix](https://community.zammad.org/u/mattronix)
#### Post date: [February 5, 2019, 10:56pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/8 "2019-02-05T22:56:39Z")
Found it /opt/zammad/vendor/lib/oauth2\_database.rb
---
### Author:  [@pawad](https://community.zammad.org/u/pawad)
#### Post date: [March 12, 2019, 2:54pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/9 "2019-03-12T14:54:54Z")
Can anyone share some client settings for keycloak that work?
I’m still wrestling with this and getting vague errors from zammad.
---
### Author:  [@timo](https://community.zammad.org/u/timo)
#### Post date: [April 4, 2019, 2:14pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/10 "2019-04-04T14:14:05Z")
I also try to figure out how to get zammad and keycloak play together. But I am little stuck…
Few basic questions
- Do I need to modify oauth2\_database.rb file by hand?
- Can group be provided from keycloak?
- Can new user login directly via Oauth2 login or do I have create user forehand to zammad?
If someone could help little bit I would be very happy 🙂
---
### Author:  [@nicolas](https://community.zammad.org/u/nicolas)
#### Post date: [April 12, 2019, 7:30am UTC](https://community.zammad.org/t/oidc-keycloak/1983/11 "2019-04-12T07:30:50Z")
Timo, did you succeed ? I also struggled to integrate Zammad with Keycloak and OIDC, but eventually got it working after modifying oauth2\_database.rb as described by fgaillard, while adjusting the UserInfo endpoint URL.
---
### Author:  [@timo](https://community.zammad.org/u/timo)
#### Post date: [April 12, 2019, 8:20am UTC](https://community.zammad.org/t/oidc-keycloak/1983/12 "2019-04-12T08:20:51Z")
Not yet. I have modified oauth2\_database.rb file like fgaillard described. But when I try to login zammad I get following error from zammad " 422: The change you wanted was rejected. Message from oauth2: invalid\_credentials". I am not sure if my dev enviroment could affect to that because I don’t have https in use (only http). Next I try on our prod enviroment where we have https certificates in use 🙂
---
### Author:  [@muristan](https://community.zammad.org/u/muristan)
#### Post date: [May 24, 2019, 4:10pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/13 "2019-05-24T16:10:14Z")
Hi,
someone using actual Zammad version 2.9 with Keycloak?
I tried to do this. But after modifying the file oauth2\_database.rb, zammad is not started anymore. Unfortunately no error message in the log.
Logfile:
I, [2019-05-24T18:24:44.951851 #30373-47097529438040] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:24:44.996864 #30317-47336712679260] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:24:54.541605 #30407-47368826384200] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:24:54.685129 #30439-46984700465000] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:24:54.721180 #30438-46982998912840] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:04.130981 #30513-47108753452880] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:04.356646 #30533-46946074996560] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:04.482935 #30571-47150401810260] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:13.847471 #30608-47298343087960] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:14.182459 #30638-47167214907240] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:14.332937 #30639-47454637977420] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:23.294963 #30707-47458085220180] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:23.486196 #30736-46950055022440] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:23.957967 #30764-47448598237020] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:32.788838 #30806-47069437874000] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:32.860718 #30805-47423005708120] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
I, [2019-05-24T18:25:33.743286 #30864-47119643750240] INFO – : Setting.set(‘product\_logo’, “e1bcceb4310ab11f0703570d79d3297f.png”)
…
I’m using zammad 2.9 on Debian Stretch.
Andreas
---
### Author:  [@MrGeneration](https://community.zammad.org/u/MrGeneration)
#### Post date: [May 24, 2019, 6:41pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/14 "2019-05-24T18:41:56Z")
Did you ensure that the formatting is correct? Ruby is very picky about that. One “Tab” would be 3 spacings. If Zammad doesn’t start, that’s a sign that formatting is wrong.
---
### Author:  [@mattronix](https://community.zammad.org/u/mattronix)
#### Post date: [May 24, 2019, 7:05pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/15 "2019-05-24T19:05:20Z")
Hi All,
I can tell you its still working on version 2.9 🙂
Upgraded last week still using keycloak, happy to help where i can!
---
### Author:  [@mattronix](https://community.zammad.org/u/mattronix)
#### Post date: [May 24, 2019, 7:07pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/16 "2019-05-24T19:07:14Z")
@muristan
you will need to change the keycloak url in this but here is what we are using in production:
[https://git.uptic.nl/snippets/15](https://git.uptic.nl/snippets/15)
---
### Author:  [@mattronix](https://community.zammad.org/u/mattronix)
#### Post date: [May 24, 2019, 7:09pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/17 "2019-05-24T19:09:53Z")
Great work your doing on zammad!
Is it on the road map to support the oauth2 `userinfo` end point?
If not anyway that i could help or package this as a plugin ?
---
### Author:  [@muristan](https://community.zammad.org/u/muristan)
#### Post date: [May 25, 2019, 12:25pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/18 "2019-05-25T12:25:26Z")
Thanks for your hints! I got Keycloak with openid connect protocol to work with Zammad. Great!! 🙂
When doing the first login using Keycloak, Zammad creates a new user. Login token is not email but the Keycloak User ID. There is no way to edit this in order to give this ID to an eyxisting user. Or did I miss something?
---
### Author:  [@mattronix](https://community.zammad.org/u/mattronix)
#### Post date: [May 25, 2019, 12:37pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/19 "2019-05-25T12:37:49Z")
our users seem to get linked by email address however our usernames are also our email addresses.
---
### Author:  [@anon29869905](https://community.zammad.org/u/anon29869905)
#### Post date: [September 18, 2019, 1:03pm UTC](https://community.zammad.org/t/oidc-keycloak/1983/20 "2019-09-18T13:03:00Z")
Hey there! I just want to share the news here that [Zammad 3.2](https://github.com/zammad/zammad/milestone/48?closed=1) will support [SAML](https://github.com/zammad/zammad/issues/2741) authentication out of the box without the need to change files. We had great support from @carl2187 who verified that Keycloak integration works as expected.
[Next page](https://community.zammad.org/t/oidc-keycloak/1983.md?page=2)