Keycloak setup (OAuth openid connect)
This is a guide to setup keycloak locally for testing with the edumeet-management-server.
Start a keycloak docker container
docker run --name keycloak -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin -e KC_HTTPS_CERTIFICATE_FILE=/opt/keycloak/conf/edumeet-demo-cert.pem -e KC_HTTPS_CERTIFICATE_KEY_FILE=/opt/keycloak/conf/edumeet-demo-key.pem -v $PWD/edumeet-demo-cert.pem:/opt/keycloak/conf/edumeet-demo-cert.pem -v $PWD/edumeet-demo-key.pem:/opt/keycloak/conf/edumeet-demo-key.pem -p 8443:8443 quay.io/keycloak/keycloak:latest start-dev
You can change the certificate/key to whichever you want, self-signed is ok for testing. Whenever this container is up and running, you can go to https://localhost:8443 and you should be presented with a login screen. Username: admin Password: admin
When you get into the administrator console, make a new realm, and call it whatever you like, in this example we call it dev.
Make sure you have selected the new realm in the dropdown in the top left.
Select client scopes on the left and create a new client scope.
Make sure the name of the new scope is openid.
Select clients on the left and create a new client.
You may choose the name of the client, in this example we chose edumeet-dev-client.
Make sure Client authentication is checked, and the rest of the options should be correct by default.
Set the Root URL to the same as the keycloak instance, in this example https://localhost:8443. Set the Valid redirect URIs and Web origins to the URL of your edumeet-management-server, in this example http://localhost:3030/*. Save the client.
Under the Credentials tab you can unveil the Client secret. Copy it as we need it in the edumeet-management-server.
Under Client scopes, make sure openid is in the list, and set to Default. If it isn't, click Add client scope at the top to add it.
Now go to Users on the left and click Create new user.
Set the various options for the user as you see fit, this is the user that will be used to log into edumeet-management-server.
Under the Credentials tab, you may set a password for the user.
Your keycloak instance should now be ready for use. If you used a self-signed certificate in keycloak, make sure you start the edumeet-management-server with NODE_TLS_REJECT_UNAUTHORIZED=0.
To configure this instance as the authentication for one of your tenants on edumeet-management-server, you will need to do a POST to the tenantOAuths endpoint to add it.
