OAuth setup with Keycloak #3428
Replies: 6 comments 21 replies
-
|
I got an error too saying "invalid scope" on mealie side and "Invalid value for parameter: scope" |
Beta Was this translation helpful? Give feedback.
-
|
Since I did not find a clear explanation in this discussion, I'm sharing what I did to get Mealie working with Keycloak. The first problem is that Keycloak does not have a scope or mapper for The second problem is PKCE. That's the easy problem to fix. Create a groups scopeStep 1: A new client scopeCreate a new "client scope" called "groups". Make it "default" if you want it in all your OpenID clients, or "optional" when not. I'm picking default, as I probably want to try to get everything on groups. step 2: mappersThen you need two mappers. That's the second tab The first is a "Group Membership" configuration. Click on
The second is a "User Attribute" configuration, where you map
Important last step!As you probably have made the client "mealie" already, you need to add the now default Client Scope "groups". So go to the tab "Client scopes", click on "add" and there you will see "groups". PKCETurn on client authentication, leave authorization off. You don't need "Service accounts roles". Like this:
The only thing you need to do, is:
Other stuffNow a bit about groups. You see it starts with a For completeness, here are my environment variables: |
Beta Was this translation helpful? Give feedback.
-
|
This did work for me, but is this really the intended design of groups within Keycloak? Reading the documentation, and having configured other apps such as Nextcloud, Jellyfin, Grafana, etc, admin and user should be set up as client roles, not groups. Groups are for grouping together multiple client roles, or client roles across multiple clients. It just seems odd that I now have to have a /mealie-user and /mealie-admin set up directly in the realm group settings. It seems messy and hurts my OCD brain. Wouldn't this be better implemented in clients -> mealie -> roles so that they are contained just to mealie and not globally to the realm? And then add the client scope mapper for mealie-dedicated for client roles? |
Beta Was this translation helpful? Give feedback.
-
|
Mmm, could be. I just went with the flow here.
So, groups would be more internally. So that means that Mealie-groups should be mapped to KC-roles? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, I think so. I'm not a developer by any means, but that's the way I'm interpreting it and the way other apps seem to handle it. I think it makes sense that way. |
Beta Was this translation helpful? Give feedback.
-
|
is it possible to do this currently with keycloak roles? or would something need to be changed in mealie to allow it? i haven't had luck so far trying, not sure if i should keep trying or if it's just not possible at the moment |
Beta Was this translation helpful? Give feedback.
-
|
Set |
Beta Was this translation helpful? Give feedback.
-
|
I manage to get it work by settings the groups scope correctly in Keycloak. But now, I’m getting an infinite loop, with « Invalid username or password » on Mealie but correct authentification on Keycloak |
Beta Was this translation helpful? Give feedback.
-
|
The infinite redirect bug has been fixed on the |
Beta Was this translation helpful? Give feedback.
-
|
I needed to empty out OIDC_USER_GROUP in the docker environment. In addition i needed to deactivate the "Client authentication" checkbox in the client settings in Keycloak. After that i was able to login. |
Beta Was this translation helpful? Give feedback.
-
|
I manage to get things working with keycloak. I added a client scope "groups" in keycloak with the following configuration: name: groups
description: Add groups to token
protocol: openid-connect
attributes:
include.in.token.scope: 'true'
display.on.consent.screen: 'true'
gui.order: ''
consent.screen.text: ''
protocolMappers:
- name: groups
protocol: openid-connect
protocolMapper: oidc-group-membership-mapper
consentRequired: false
config:
full.path: 'true'
introspection.token.claim: 'true'
userinfo.token.claim: 'true'
multivalued: 'true'
id.token.claim: 'true'
access.token.claim: 'true'
claim.name: groupsThen I added a client for mealie: client_id: mealie
description: Client use to connect to mealie
root_url: https://mealie.example.com
admin_url: https://mealie.example.com
base_url: https://mealie.example.com/g/home
surrogate_auth_required: false
enabled: true
always_display_in_console: true
redirectUris:
- https://mealie.example.com/login?direct=1
- https://mealie.example.com/login
webOrigins:
- https://mealie.example.com
standard_flow_enabled: true
implicit_flow_enabled: false
direct_access_grants_enabled: false
service_accounts_enabled: false
public_client: true
frontchannel_logout: true
client_authenticator_type: client-secret
protocol: openid-connect
defaultClientScopes:
- profile
- email
- groups
attributes:
user.info.response.signature.alg: RS256
post.logout.redirect.uris: https://mealie.example.com/login?direct=1##https://mealie.example.com/login
oauth2.device.authorization.grant.enabled: 'false'
access.token.signed.response.alg: RS256
backchannel.logout.revoke.offline.tokens: 'false'
use.refresh.tokens: 'true'
oidc.ciba.grant.enabled: 'false'
id.token.signed.response.alg: RS256
backchannel.logout.session.required: 'true'
client_credentials.use_refresh_token: 'false'
require.pushed.authorization.requests: 'false'
tls.client.certificate.bound.access.tokens: 'false'
authorization.signed.response.alg: RS256
display.on.consent.screen: 'false'
pkce.code.challenge.method: S256
token.response.type.bearer.lower-case: 'false'And finally I have use the following configuration in mealie: - OIDC_AUTH_ENABLED=true
- OIDC_SIGNUP_ENABLED=true
- OIDC_CONFIGURATION_URL=https://keycloak.example.com/realms/example/.well-known/openid-configuration
- OIDC_CLIENT_ID=mealie
- OIDC_USER_GROUP=/read
- OIDC_ADMIN_GROUP=/admin
- OIDC_SIGNING_ALGORITHM=RS256Beware that since in the scope I enable full path on group mapper I need to add a |
Beta Was this translation helpful? Give feedback.
-
|
I'm kind of lost with my implementation with traefik + cloudflare but it's just a reload loop on nightly. I have several other OIDC enabled apps on this box. I have made sure to clone the settings of everyone that has said they got it working. Well-known is 100% accessible... |
Beta Was this translation helpful? Give feedback.
-
|
Anything in your Keycloak logs? |
Beta Was this translation helpful? Give feedback.
-
|
Not anything that seems relevant? |
Beta Was this translation helpful? Give feedback.
-
|
Can you ping Keycloak or the openid configuration url from within the Mealie container? |
Beta Was this translation helpful? Give feedback.
-
|
Looks like no... This is actually a strict cloudflare rule now that you had me do that. Thank you for your time. |
Beta Was this translation helpful? Give feedback.
-
|
Hi everyone I am trying to setup keycloak with mealie but not successful for now :/ My current setup is not redirecting to keycloak and I don't get why. When I press 'Login with OAuth' it tries to access 'mealie.mydomain.com/null?protocol=oauth2&response_type=code&access_type&client_id...' instead of keycloak.mydomain.com/... does anyone have an idea? These are my environment variables for mealie |
Beta Was this translation helpful? Give feedback.
-
|
@ToshY I'm just a contributor, not on the core team, so I don't know. In the discord, I recall seeing they were still targeting sometime this month |
Beta Was this translation helpful? Give feedback.
-
|
Me seeing these messages earlier today 😰 https://github.com/mealie-recipes/mealie/releases/tag/v2.0.0 |
Beta Was this translation helpful? Give feedback.
-
|
Thank you both for your replies 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
Okay, i added the client secret, but I get an error when I try to authenticate: [...] Invalid scopes: openid email profile groups |
Beta Was this translation helpful? Give feedback.
-
|
nvm I figured that one, i had to add group to the client scopes |
Beta Was this translation helpful? Give feedback.
-
Configuration Example
I'm trying to use Keycloak as login provider in Mealie. For that i have tinkered around with some environment settings, but cant get it running. Could someone help?
In Keycloak i use (i skipped the url block, because that only contains https:/// and alike):
Client ID: mealie
Client authentication: on
Authorization: on
Authentication flow: standard low and direkt access grants
What do i miss?
Beta Was this translation helpful? Give feedback.
All reactions