How can I use external OAuth2 Provider such as Gitlab or Github to replace the KeyCloak?

[inlann]

Hello:

I noticed that the Theia-cloud use the KeyCloak to authorize and manage users. We are new to the KeyCloak framework and the authorization flow in the KeyCloak may be diffcult to us. So, is there any way to use an external OAuth2 Provider such as Gitlab or Github to replace the KeyCloak component?

Really appreciate!

[jfaltermeier]

At the moment there is no way to fully replace it.
Keycloak supports the concept of Identity providers however: https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_broker
With this it is possible to delegate to other social auth providers like Github, Gitlab, Google, and so on.
https://www.keycloak.org/docs/latest/server_admin/index.html#_github
https://www.keycloak.org/docs/latest/server_admin/index.html#gitlab

[inlann]

Really appreciate!! I'll try it.

[wyhdil]

@jfaltermeier Hello, I also tried using gitlab as Identity provider：

And also configured it in gitlab：

But when I logged in using gitlab authorization in theiacloud, an error occurred：

I don't know what causes this error.
Is there an error in my configuration, such as an error in the callback URL in gitlab?

Or does oauth2-proxy need some configuration to support authorized login of gitlab?

Can you help me how to solve this problem？Thanks!

[wyhdil]

@jfaltermeier There are some new discoveries,i added the emial option in the scope tab of gitlab.

Other than that, no other configuration changes were made.

But when I looked at the User page of keycloak, I found that there were some abnormalities in the account logged in using gitlab.

Because I knew that the Email verified switch should be turned on when configuring the correct user information, so I manually turned on the Email verified of the wyhdil account.

Then I tried to log in using gitlab authorization and used the wyhdil account, and finally successfully opened the correct session.

So the above problem should be because the user’s Email is verified.
But I want to know if this is due to missing configuration? After all, it’s impossible to manually turn on the Email verified switch every time.

[jfaltermeier]

I believe that on the Gitab Identity Provider page under Advanced Settings, there is a "Trust Email" switch.
With this all mails should be set to verified. (I am not sure what happens with existing users though)

[wyhdil]

Ok,this really works!!!! Thank you soooooo much!