Keycloak configuration 'how to'.
## Credentials
-Credentials section in main Artipie configuration allows to set three various credentials sources:
-`yaml` file with users list, GitHub accounts and user from environment. Here is the example of the
+Credentials section in main Artipie configuration allows to set four various credentials sources:
+`yaml` file with users list, GitHub accounts, user from environment and Keycloak authorization. Here is the example of the
full `credentials` section:
```yaml
@@ -14,6 +14,12 @@ meta:
type: github
-
type: env
+ -
+ type: keycloak
+ url: http://localhost:8080
+ realm: realm_name
+ client-id: client_application_id
+ client-password: client_application_password
```
Each item of `credentials` list has only one required field - `type`, which determines the type of
authentication:
@@ -21,6 +27,7 @@ authentication:
`path` field value, it's relative to main configuration storage)
- `github` is for auth via GitHub
- `env` authenticates by credentials from environment
+- `keycloak` is for auth via Keycloak
When several credentials types are set, Artipie tries to authorize user via each method.
@@ -74,3 +81,30 @@ docker run -d -v /var/artipie:/var/artipie` -p 80:80 \
Authentication from environment allows adding only one user and is meant for tests or try-it-out
purposes only.
+
+### Credentials type `keycloak`
+
+If the 'type' is set to `keycloak`, the following Yaml attributes are required:
+* `url` Keycloak authentication server url.
+* `realm` Keycloak realm.
+* `client-id` Keycloak client application id.
+* `client-password` Keycloak client application password.
+
+Example:
+```yaml
+meta:
+ credentials:
+ -
+ type: keycloak
+ url: http://localhost:8080
+ realm: demorealm
+ client-id: demoapp
+ client-password: secret
+```
+
+To interact with Keycloak server the Artipie uses `Direct Access Grants` authentication flow
+and directly requests user login and password.
+Artipie acts as Keycloak client application and should be configured in Keycloak with following settings :
+* Client authentication: On
+* Authorization: On
+* Authentication flow: `Direct access grants`
\ No newline at end of file
