github.com/argoproj/argo-cd/v2@v2.10.9/docs/operator-manual/user-management/keycloak.md (about) 1 # Keycloak 2 3 # Integrating Keycloak and ArgoCD 4 5 These instructions will take you through the entire process of getting your ArgoCD application authenticating with Keycloak. 6 You will create a client within Keycloak and configure ArgoCD to use Keycloak for authentication, using groups set in Keycloak 7 to determine privileges in Argo. 8 9 ## Creating a new client in Keycloak 10 11 First we need to setup a new client. Start by logging into your keycloak server, select the realm you want to use (`master` by default) 12 and then go to __Clients__ and click the __Create client__ button at the top. 13 14  15 16 Enable the __Client authentication__. 17 18  19 20 Configure the client by setting the __Root URL__, __Web origins__, __Admin URL__ to the hostname (https://{hostname}). 21 22 Also you can set __Home URL__ to your _/applications_ path and __Valid Post logout redirect URIs__ to "+". 23 24 The Valid Redirect URIs should be set to https://{hostname}/auth/callback (you can also set the less secure https://{hostname}/* for testing/development purposes, 25 but it's not recommended in production). 26 27  28 29 Make sure to click __Save__. There should be a tab called __Credentials__. You can copy the Secret that we'll use in our ArgoCD 30 configuration. 31 32  33 34 ## Configuring the groups claim 35 36 In order for ArgoCD to provide the groups the user is in we need to configure a groups claim that can be included in the authentication token. 37 To do this we'll start by creating a new __Client Scope__ called _groups_. 38 39  40 41 Once you've created the client scope you can now add a Token Mapper which will add the groups claim to the token when the client requests 42 the groups scope. In the Tab "Mappers", click on "Configure a new mapper" and choose __Group Membership__. 43 Make sure to set the __Name__ as well as the __Token Claim Name__ to _groups_. Also disable the "Full group path". 44 45  46 47 We can now configure the client to provide the _groups_ scope. Go back to the client we've created earlier and go to the Tab "Client Scopes". 48 Click on "Add client scope", choose the _groups_ scope and add it either to the __Default__ or to the __Optional__ Client Scope. If you put it in the Optional 49 category you will need to make sure that ArgoCD requests the scope in its OIDC configuration. Since we will always want group information, I recommend 50 using the Default category. 51 52  53 54 Create a group called _ArgoCDAdmins_ and have your current user join the group. 55 56  57 58 ## Configuring ArgoCD OIDC 59 60 Let's start by storing the client secret you generated earlier in the argocd secret _argocd-secret_. 61 62 1. First you'll need to encode the client secret in base64: `$ echo -n '83083958-8ec6-47b0-a411-a8c55381fbd2' | base64` 63 2. Then you can edit the secret and add the base64 value to a new key called _oidc.keycloak.clientSecret_ using `$ kubectl edit secret argocd-secret`. 64 65 Your Secret should look something like this: 66 67 ```yaml 68 apiVersion: v1 69 kind: Secret 70 metadata: 71 name: argocd-secret 72 data: 73 ... 74 oidc.keycloak.clientSecret: ODMwODM5NTgtOGVjNi00N2IwLWE0MTEtYThjNTUzODFmYmQy 75 ... 76 ``` 77 78 Now we can configure the config map and add the oidc configuration to enable our keycloak authentication. 79 You can use `$ kubectl edit configmap argocd-cm`. 80 81 Your ConfigMap should look like this: 82 83 ```yaml 84 apiVersion: v1 85 kind: ConfigMap 86 metadata: 87 name: argocd-cm 88 data: 89 url: https://argocd.example.com 90 oidc.config: | 91 name: Keycloak 92 issuer: https://keycloak.example.com/realms/master 93 clientID: argocd 94 clientSecret: $oidc.keycloak.clientSecret 95 requestedScopes: ["openid", "profile", "email", "groups"] 96 ``` 97 98 Make sure that: 99 100 - __issuer__ ends with the correct realm (in this example _master_) 101 - __issuer__ on Keycloak releases older than version 17 the URL must include /auth (in this example /auth/realms/master) 102 - __clientID__ is set to the Client ID you configured in Keycloak 103 - __clientSecret__ points to the right key you created in the _argocd-secret_ Secret 104 - __requestedScopes__ contains the _groups_ claim if you didn't add it to the Default scopes 105 106 ## Configuring ArgoCD Policy 107 108 Now that we have an authentication that provides groups we want to apply a policy to these groups. 109 We can modify the _argocd-rbac-cm_ ConfigMap using `$ kubectl edit configmap argocd-rbac-cm`. 110 111 ```yaml 112 apiVersion: v1 113 kind: ConfigMap 114 metadata: 115 name: argocd-rbac-cm 116 data: 117 policy.csv: | 118 g, ArgoCDAdmins, role:admin 119 ``` 120 121 In this example we give the role _role:admin_ to all users in the group _ArgoCDAdmins_. 122 123 ## Login 124 125 You can now login using our new Keycloak OIDC authentication: 126 127 