OAuth setup with Keycloak #3428
Replies: 6 comments 8 replies
-
|
I got an error too saying "invalid scope" on mealie side and "Invalid value for parameter: scope" |
Beta Was this translation helpful? Give feedback.
-
|
Does Keycloak not tell you what the invalid scope value is? These are the scopes that should be configured in Keycloak: There was someone on Discord setting up for Keycloak and said they needed a custom mapper for groups. Maybe this thread would help: https://discord.com/channels/795445547577770014/795489625803849740/1219618707953946686 |
Beta Was this translation helpful? Give feedback.
-
|
Can you share the solution here? I've got the same problem, but that link doesn't seem to work. |
Beta Was this translation helpful? Give feedback.
-
|
Set |
Beta Was this translation helpful? Give feedback.
-
|
I manage to get it work by settings the groups scope correctly in Keycloak. But now, I’m getting an infinite loop, with « Invalid username or password » on Mealie but correct authentification on Keycloak |
Beta Was this translation helpful? Give feedback.
-
|
The infinite redirect bug has been fixed on the |
Beta Was this translation helpful? Give feedback.
-
|
I needed to empty out OIDC_USER_GROUP in the docker environment. In addition i needed to deactivate the "Client authentication" checkbox in the client settings in Keycloak. After that i was able to login. |
Beta Was this translation helpful? Give feedback.
-
|
I manage to get things working with keycloak. I added a client scope "groups" in keycloak with the following configuration: name: groups
description: Add groups to token
protocol: openid-connect
attributes:
include.in.token.scope: 'true'
display.on.consent.screen: 'true'
gui.order: ''
consent.screen.text: ''
protocolMappers:
- name: groups
protocol: openid-connect
protocolMapper: oidc-group-membership-mapper
consentRequired: false
config:
full.path: 'true'
introspection.token.claim: 'true'
userinfo.token.claim: 'true'
multivalued: 'true'
id.token.claim: 'true'
access.token.claim: 'true'
claim.name: groupsThen I added a client for mealie: client_id: mealie
description: Client use to connect to mealie
root_url: https://mealie.example.com
admin_url: https://mealie.example.com
base_url: https://mealie.example.com/g/home
surrogate_auth_required: false
enabled: true
always_display_in_console: true
redirectUris:
- https://mealie.example.com/login?direct=1
- https://mealie.example.com/login
webOrigins:
- https://mealie.example.com
standard_flow_enabled: true
implicit_flow_enabled: false
direct_access_grants_enabled: false
service_accounts_enabled: false
public_client: true
frontchannel_logout: true
client_authenticator_type: client-secret
protocol: openid-connect
defaultClientScopes:
- profile
- email
- groups
attributes:
user.info.response.signature.alg: RS256
post.logout.redirect.uris: https://mealie.example.com/login?direct=1##https://mealie.example.com/login
oauth2.device.authorization.grant.enabled: 'false'
access.token.signed.response.alg: RS256
backchannel.logout.revoke.offline.tokens: 'false'
use.refresh.tokens: 'true'
oidc.ciba.grant.enabled: 'false'
id.token.signed.response.alg: RS256
backchannel.logout.session.required: 'true'
client_credentials.use_refresh_token: 'false'
require.pushed.authorization.requests: 'false'
tls.client.certificate.bound.access.tokens: 'false'
authorization.signed.response.alg: RS256
display.on.consent.screen: 'false'
pkce.code.challenge.method: S256
token.response.type.bearer.lower-case: 'false'And finally I have use the following configuration in mealie: - OIDC_AUTH_ENABLED=true
- OIDC_SIGNUP_ENABLED=true
- OIDC_CONFIGURATION_URL=https://keycloak.example.com/realms/example/.well-known/openid-configuration
- OIDC_CLIENT_ID=mealie
- OIDC_USER_GROUP=/read
- OIDC_ADMIN_GROUP=/admin
- OIDC_SIGNING_ALGORITHM=RS256Beware that since in the scope I enable full path on group mapper I need to add a |
Beta Was this translation helpful? Give feedback.
-
|
I'm kind of lost with my implementation with traefik + cloudflare but it's just a reload loop on nightly. I have several other OIDC enabled apps on this box. I have made sure to clone the settings of everyone that has said they got it working. Well-known is 100% accessible... |
Beta Was this translation helpful? Give feedback.
-
|
Anything in your Keycloak logs? |
Beta Was this translation helpful? Give feedback.
-
|
Not anything that seems relevant? |
Beta Was this translation helpful? Give feedback.
-
|
Can you ping Keycloak or the openid configuration url from within the Mealie container? |
Beta Was this translation helpful? Give feedback.
-
|
Looks like no... This is actually a strict cloudflare rule now that you had me do that. Thank you for your time. |
Beta Was this translation helpful? Give feedback.
-
|
Hi everyone I am trying to setup keycloak with mealie but not successful for now :/ My current setup is not redirecting to keycloak and I don't get why. When I press 'Login with OAuth' it tries to access 'mealie.mydomain.com/null?protocol=oauth2&response_type=code&access_type&client_id...' instead of keycloak.mydomain.com/... does anyone have an idea? These are my environment variables for mealie |
Beta Was this translation helpful? Give feedback.
-
Configuration Example
I'm trying to use Keycloak as login provider in Mealie. For that i have tinkered around with some environment settings, but cant get it running. Could someone help?
In Keycloak i use (i skipped the url block, because that only contains https:/// and alike):
Client ID: mealie
Client authentication: on
Authorization: on
Authentication flow: standard low and direkt access grants
What do i miss?
Beta Was this translation helpful? Give feedback.
All reactions