OpenID Connect v1.0 identity providers

Authorization URL

The authorization URL endpoint the OIDC protocol requires.

Token URL

The token URL endpoint the OIDC protocol requires.

Logout URL

The logout URL endpoint in the OIDC protocol. This value is optional.

Backchannel Logout

A background, out-of-band, REST request to the IDP to log out the user. Some IDPs perform logout through browser redirects only, as they may identify sessions using a browser cookie.

User Info URL

An endpoint the OIDC protocol defines. This endpoint points to user profile information.

Client Authentication

Defines the Client Authentication method Keycloak uses with the Authorization Code Flow. In the case of JWT signed with a private key, Keycloak uses the realm private key. In the other cases, define a client secret. See the Client Authentication specifications for more information.

Client ID

A realm acting as an OIDC client to the external IDP. The realm must have an OIDC client ID if you use the Authorization Code Flow to interact with the external IDP.

Client Secret

Client secret from an external vault. This secret is necessary if you are using the Authorization Code Flow.

Client Assertion Signature Algorithm

Signature algorithm to create JWT assertion as client authentication. In the case of JWT signed with private key or Client secret as jwt, it is required. If no algorithm is specified, the following algorithm is adapted. RS256 is adapted in the case of JWT signed with private key. HS256 is adapted in the case of Client secret as jwt.

Issuer

Keycloak validates issuer claims, in responses from the IDP, against this value.

Default Scopes

A list of OIDC scopes Keycloak sends with the authentication request. The default value is openid. A space separates each scope.

Prompt

The prompt parameter in the OIDC specification. Through this parameter, you can force re-authentication and other options. See the specification for more details.

Accepts prompt=none forward from client

Specifies if the IDP accepts forwarded authentication requests containing the prompt=none query parameter. If a realm receives an auth request with prompt=none, the realm checks if the user is currently authenticated and returns a login_required error if the user has not logged in. When Keycloak determines a default IDP for the auth request (using the kc_idp_hint query parameter or having a default IDP for the realm), you can forward the auth request with prompt=none to the default IDP. The default IDP checks the authentication of the user there. Because not all IDPs support requests with prompt=none, Keycloak uses this switch to indicate that the default IDP supports the parameter before redirecting the authentication request.

If the user is unauthenticated in the IDP, the client still receives a login_required error. If the user is authentic in the IDP, the client can still receive an interaction_required error if Keycloak must display authentication pages that require user interaction. This authentication includes required actions (for example, password change), consent screens, and screens set to display by the first broker login flow or post broker login flow.

Validate Signatures

Specifies if Keycloak verifies signatures on the external ID Token signed by this IDP. If ON, Keycloak must know the public key of the external OIDC IDP. For performance purposes, Keycloak caches the public key of the external OIDC identity provider.

Use JWKS URL

This switch is applicable if Validate Signatures is ON. If Use JWKS URL is ON, Keycloak downloads the IDP’s public keys from the JWKS URL. New keys download when the identity provider generates a new keypair. If OFF, Keycloak uses the public key (or certificate) from its database, so when the IDP keypair changes, import the new key to the Keycloak database as well.

JWKS URL

The URL pointing to the location of the IDP JWK keys. For more information, see the JWK specification. If you use an external Keycloak as an IDP, you can use a URL such as http://broker-keycloak:8180/realms/test/protocol/openid-connect/certs if your brokered Keycloak is running on http://broker-keycloak:8180 and its realm is test.

Validating Public Key

The public key in PEM format that Keycloak uses to verify external IDP signatures. This key applies if Use JWKS URL is OFF.

Validating Public Key Id

This setting applies if Use JWKS URL is OFF. This setting specifies the ID of the public key in PEM format. Because there is no standard way for computing key ID from the key, external identity providers can use different algorithms from what Keycloak uses. If this field’s value is not specified, Keycloak uses the validating public key for all requests, regardless of the key ID sent by the external IDP. When ON, this field’s value is the key ID used by Keycloak for validating signatures from providers and must match the key ID specified by the IDP.