Contents

OAuth/OpenID Single Sign On (SSO) into Confluence using Keycloak

Confluence OAuth/OpenID app gives the ability to enable OAuth/OpenID Single Sign-On for Confluence. Confluence is compatible with all OAuth/OpenID Providers. Here we will go through a guide to configure SSO between Confluence and your OAuth/OpenID Provider. By the end of this guide, users from your OAuth/OpenID Provider should be able to log in and register to Confluence.

You can refer the steps to configure Keycloak as OpenID Provider with the Confluence OAuth Client from the video or documentation given below

Pre-requisites

To integrate your OAuth/OpenID provider with Confluence, you need the following items:

Confluence should be installed and configured.
Confluence Server is https enabled (optional).
Admin credentials are set up in Confluence.
Valid Confluence Server and Data center Licence.

Download And Installation

Log into your Confluence instance as an admin.
Navigate to the settings menu and Click Manage Apps.
Click Find new apps or Find new add-ons from the left-hand side of the page.
Locate Confluence OAuth/OpenID Connect Single Sign On (SSO), Confluence SSO via search.
Click Try free to begin a new trial or Buy now to purchase a license for OAuth/OpenID Connect for Confluence SSO.
Enter your information and click Generate license when redirected to MyAtlassian.
Click Apply license.

Step 1: Setup Keycloak as OAuth Provider

Follow the following steps to configure Keycloak as IdP to achieve Keycloak SSO

Select Keycloak version:

Pre-requisites : Download And Installation

First of all, Download Keycloak and install it.
Start the keycloak server based on your keycloak version. (See table below)

For the Keycloak Version 16 and below	Go to the Root Directory of keycloak bin standalone.sh
For the Keycloak Version 17 and above	Go to the Root Directory of keycloak bin kc.bat and run the below commands. 1. kc.bat build 2. kc.bat start-dev

Configure Keycloak as IdP

Add Realm : Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Add Realm option.

Keycloak SSO - Keycloak OAuth Single Sign-On - add realm

Create realm: Enter Realm Name and keep the realm name handy as it will required later to configure the Realm under the plugin. Click on CREATE to add realm.

Create OpenID client: Click on the Clients and choose create to create a new client. Enter client id and select client protocol openeid-connect and select Save.

Keycloak SSO - Keycloak OAuth Single Sign-On - client id

Change Access type: After client is created change its access type to confidential.

Keycloak SSO - Keycloak OAuth Single Sign-On - change access type

Enter Valid Redirect URIs: Copy callback URL from plugin and then click on SAVE. Ex -- https:///oauth/callback

Get Client Secret: Now we need to get client secret. So select Clients and select credentials and copy your secret from here.

Keycloak SSO - Keycloak OAuth Single Sign-On - client id client secret

Plugin Configuration: Enter copied Client Secret under Client secret field in the OAuth Client plugin, and enter the Client Name under the Client ID field.
Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and choose to Add a new User.

Keycloak SSO - Keycloak OAuth Single Sign-On - add user

User Configuration: After user is created following action needs to be performed on it.

Credentials

Keycloak SSO - Keycloak OAuth Single Sign-On - set password

NOTE : Disabling Temporary will make user password permanent.

Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles and clicking on add selected.

Keycloak SSO - Keycloak OAuth Single Sign-On - map user

Create ROLE: The Role will be used by your applications to define which users will be authorized to access the application. Click on the Roles and choose Add Role.

Keycloak SSO - Keycloak OAuth Single Sign-On - add role

Step 1.1: Steps to fetch Keycloak Groups [Premium]

Create groups: Click on the Groups and choose New to create a new group.

Keycloak SSO - Keycloak OAuth Single Sign-On - create group

Assign user to group: Select the user whom you want to add in group. Choose Groups option from tab and then select the group-name and click on join.

Keycloak SSO - Keycloak OAuth Single Sign-On - assign group

Keycloak Group Mapper: Now to get group details we need to perform its client mapping with group membership else group details will not be fetched. So in Client section, select your client and then click on mapper->create.

Keycloak SSO - Keycloak OAuth Single Sign-On - group mapper

Now, select mapper type as Group Membership and enter the name and token claim name i.e the attribute name corresponding to which groups will be fetched. Turn Off the full group path, Add to ID token and Add to access token options, and click on Save.

Note: -- If full path is on group path will be fetched else group name will be fetched.

Step 1.2: Steps to fetch Keycloak Roles [Premium]

Keycloak Role Mapper: Now to get role details we need to perform its client mapping with role membership else role details will not be fetched. So in Client section, select your client and then click on mapper->create.

Now, select mapper type as user realm Role Membership and enter the name. and token claim name i.e the attribute name corresponding to which groups will be fetched. Add to ID token and Add to access token options, and click on Save.

Add Realm : Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Create Realm option.

Create realm: Enter Realm Name and keep the realm name handy as it will required later to configure the Realm under the OAuth Client plugin. Click on CREATE to add realm.

Keycloak SSO - Keycloak OAuth Single Sign-On - Create realm

Create OpenID client: Click on the Clients and choose Create Client to create a new client. Enter Client id and select client protocol openeid-connect and Click Next.

Keycloak SSO - Keycloak OAuth Single Sign-On - Create client

Keycloak SSO - Keycloak OAuth Single Sign-On - Add client id

Enable the Client Authentication and Authorization toggle.

Keycloak SSO - Keycloak OAuth Single Sign-On - Enable toggle

Scroll down to the Access settings and enter your Callback/Redirect URL which you will get from your plugin present on your Client side under the CallBack URLs text-field.

Keycloak SSO - Keycloak OAuth Single Sign-On - callback url

Go to the Credentials tab, copy the Client Secret and keep it handy as we will require it later while configuring plugin.

Keycloak SSO - Keycloak OAuth Single Sign-On - Copy client secret

Plugin Configuration: Enter copied Client Secret under Client secret field in the OAuth Client plugin, and enter the Client ID under the Client ID field.
Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and Click on Create new user to Add a new User.

User Configuration: After user is created following action needs to be performed on it.

Credentials

NOTE : Disabling Temporary will make user password permanent.

Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles.

Create ROLE: The Role will be used by your applications to define which users will be authorized to access the application. Click on the Roles and choose Create Role.

Add Realm : Now login to keycloak administration console and navigate to your desired realm. You can add new realm by selecting Create Realm option.

Create realm: Enter Realm Name and keep the realm name handy as it will required later to configure the Realm under the OAuth Client plugin. Click on CREATE to add realm.

Create OpenID client: Click on the Clients and choose Create Client to create a new client. Enter Client id and select client protocol openeid-connect and Click Next.

Enable the Client Authentication and Authorization toggle.

Scroll down to the Access settings and enter your Callback/Redirect URL which you will get from your plugin present on your Client side under the CallBack URLs text-field.

Go to the plugin and copy the Client Secret and keep it handy as we will require it later while configuring plugin.

Plugin Configuration: Enter copied Client Secret under Client secret field in the plugin, and enter the Client ID under the Client ID field.
Add User: We need to add users to realm who will be able to access the resources of realm. Click on the Users and Click on Create new user to Add a new User.

User Configuration: After user is created following action needs to be performed on it.

Credentials

NOTE : Disabling Temporary will make user password permanent.

Map User: We need to map user to a role. Click on Role Mappings and assign the user desired role from available roles.

Step 2: Setup Confluence as OAuth Client

Go to Configure OAuth tab, enter copied Client ID, Secret in the plugin.
Enter the Host Name (Base URL of the Keycloak server For eg. http://example.com) and Realm Name you copied from the keycloak server.
Enter JWKS EndPoint URL or Public Key for signature validation.
eg.http://${yourKeycloakDomain}/auth/realms/${realmName}/protocol/openid-connect/certs
Click on Test Configuration.

Confluence OAuth / OPenID Single Sign On (SSO) using Keycloak, Configuration

Step 3: User Profile

Matching a User

a. Finding correct attributes

Go to Configure OAuth tab. Scroll down and click on Test Configuration.
You will see all the values returned by your OAuth/OpenID Provider to Confluence in a table. If you don't see a value for First Name, Last Name, Email or Username, make the required settings in your OAuth/OpenID Provider to return this information.
Once you see all the values in Test Configuration, keep the window open and go to User Profile tab.

b. Setting profile attributes

In this tab, fill the values by matching the name of the attribute. For instance, if the Attribute Name in the Test Configuration window is NameID, enter NameID against Username

Setting up both Username and Email is required if you want to let users register. If you want existing users to the only login, configure the attribute using which you will match the user in Confluence.

c. Matching a User

Go to User Profile tab
Select Username or Email for Login/Search Confluence user account by
Enter the attribute name from OAuth/OpenID Provider which corresponds to Username or Email using Finding Correct Attributes

d. Custom Attribute Mapping

The custom attributes recieved in the OAuth/OpenID response can be configured using Configure User Properties(Custom Attributes) option.
Click Add Attributes .
Enter the attribute name( E.g. department) as User Property Key.
This option will be added in the profiles of Confluence Users.
Corresponding to this key, fill the attribute value you recieved in Test Configuration window. For instance, if the Attribute Name in the Test Configuration window is Department, enter Department as Attribute.
Another attribute e.g. location can be added by reclicking on Add Attributes option.

Step 4: User Groups

Disable Group Mapping

a. Setting default group

Select the users' Default Group in the tab User Groups. If no group is mapped, users are added by default to this group.
You can enable default groups for All Users or New Users using the option.Select None if you don't want to assign any default group to SSO users, using the option Assign Default Group To.

OAuth / OpenID Single Sign On (SSO) into Confluence, Default group

b. Finding Group Attribute

Just like we found Attribute Name for User Profile attributes, we find group attribute.
Go to Configure OAuth tab. Scroll down and click on Test Configuration.
You will see all the values returned by your OAuth/OpenID Provider to Confluence in a table. If you don't see value with groups, make the required settings in your OAuth Providerto return group names.
Once you see all the values in Test Configuration, keep the window open and go to User Groups tab.
Enter the Attribute Name of group against Group Attribute.
Check Disable Group Mapping option if you don't want to update groups of existing users.

c. Group Mapping

Manual group mapping: If the names of groups in Confluence are different than the corresponding groups in OAuth/OpenID Provider, then you should use Manual group mapping.
On-The-Fly group mapping: If the names of groups in Confluence and OAuth/OpenID Provider are same, you should use On-The-Fly group mapping.

I. Manual Group Mapping
- Check Restrict User Creation Based on Group Mapping option if you want new users to be created only if at least one of the user's OAuth/OpenID Provider groups is mapped to a group in the application.
- For mapping, first select a Confluence group from the dropdown which lists all groups present in Confluence and then enter the name of the OAuth/OpenID Provider group to be mapped in the textbox beside
- For example, if you want all users in 'dev' group in OAuth/OpenID Provider to be added to confluence-users, you will need to select confluence-users from the dropdown and enter 'dev' against confluence-users.
- Use '+1' and '+10' buttons to add extra mapping fields.
- Use '-' button next to each mapping to delete that mapping.
II. On-The Fly Group Mapping
- Check Create New Groups option if you want new groups from OAuth/OpenID Provider to be created if not found in Confluence.
- If the user is part of some group in Confluence and that group is not present in the OAuth/OpenID response returned by OAuth/OpenID Provider, then the user will be removed from that group in Confluence.
- If you don't want On-The-Fly group mapping to affect Confluence groups which are managed locally then add those groups in Exclude Groups field.

Step 5: Sign In Settings

a. Sign In Settings

Set Enable SSO for Confluence to allow SSO for Confluence users.
Change the text on the SSO button on the login page using the Login Button Text option.
Set the Relay State to the URL to which the users would be redirected after login. Keep this empty to redirect users to the same page they started with.
Enable Auto-redirect to OAuth/OpenId Provider if you want to allow users to login only using OAuth/OpenId Provider. Enable backdoor for emergency.
Restrict the access of backdoor URL to limited users by using the Restrict backdoor URL access based on user groups feature.
Use Domain Restriction to allow login to only a specific set of users. You can configure multiple domains (semicolon-separated).
For example, if only 'miniorange.in' and 'gmail.com' domains are allowed then, the user test@miniorange.in and test@gmail.com will be able to log in and user test@yahoo.com will not be able to login.
Select Secure Admin Login Options to control admin access. User needs to authenticate again to access admin settings or to perform any admin operation. This helps you to add an extra level of security for admin access.

OAuth / OpenID Single Sign On (SSO) into Confluence , Sign In Settings

b. Sign Out Settings

Set Logout URL or Logout Template to redirect users after logout action.

OAuth / OpenID Single Sign On (SSO) into Confluence, Sign Out Settings

d. SSO Error Settings

Set error template to redirect users to a custom error page instead of login page. Use this if you have Auto-redirect to Provider enabled.

OAuth / OpenID Single Sign On (SSO) into Confluence, Error Settings

Hi! Do you need help with this guide?

Thank you for your response. We will get back to you soon.

Something went wrong. Please submit your query again

Sync product to woocommerce store from Amrod

Recommended Add-Ons

Two Factor Authentication

Enable 2FA/MFA for users & groups and let users configure 2FA during their first login.

Know More

User Sync SCIM Provisioning

Synchronize users, groups & directory with SCIM & REST APIs for Server/DC

Know More

API Token Authentication

Secure your Confluence Data Center/Server REST API using API Tokens instead of passwords.

Know More