Keycloak
Configure Keycloak as your identity provider for user authentication. Atolio signs users in using the OpenID Connect authorization code flow against a client you create in your Keycloak realm.
Create OIDC Client
Note: The instructions in this section are only needed when Keycloak is used for authentication of the Atolio web application.
- Sign in to the Keycloak admin console and select the realm your users authenticate against from the realm selector in the top-left.
- Navigate to “Clients” and click “Create client”.
- Leave “Client type” set to “OpenID Connect”, enter a “Client ID” (e.g.
atolio), and click “Next”. - Turn on “Client authentication” so the client is confidential and issues a client secret. Leave “Standard flow” enabled under “Authentication flow”; the other flows are not required. Click “Next”.
- Under “Valid redirect URIs”, add
https://search.example.com/auth/_callback(replacesearch.example.comwith your actual Atolio deployment URL; contact your Atolio onboarding support team if you need clarification on the correct URL). - (Optional) Set “Valid post logout redirect URIs” and “Web origins” to
https://search.example.comto scope sign-out and CORS to your deployment. - Click “Save”.
- Open the “Credentials” tab and copy the “Client secret”. You’ll provide it to Atolio Support as described in What to Provide to Atolio Support.
The profile and email scopes are part of Keycloak’s default client scopes, so the realm already returns the claims Atolio needs. No custom scope or mapper configuration is required.
What to Provide to Atolio Support
After completing the steps above, send the following values to Atolio Support (your Deployment Engineer).
| Value | Where to find it | Example / format | Secret |
|---|---|---|---|
| Issuer URL | Your Keycloak host plus the realm selected in step 1 | https://keycloak.example.com/realms/<realm> | No |
| Client ID | Step 3, the “Client ID” you entered | atolio | No |
| Client Secret | Step 8, the client’s “Credentials” tab | Long random string | Yes |
Keep secrets secure: Share values marked “Yes” in the Secret column only through a password-manager share (e.g. 1Password) or another secure channel agreed with Atolio Support. Never send them in plain email, chat, or support tickets.
Setup Keycloak Connector
Once your Atolio infrastructure has been deployed, you will also need to setup the Keycloak Connector so that Atolio can resolve each signed-in user to their Atolio identity and user mappings.