mirror of
https://github.com/danny-avila/LibreChat.git
synced 2025-12-17 17:00:15 +01:00
1bafe80e78
* feat: add possibility to filter by roles for OpenID provider --------- Co-authored-by: Sirius <siriusfrk@gmail.com>
68 lines
3 KiB
Markdown
68 lines
3 KiB
Markdown
---
|
||
title: Keycloak
|
||
description: Learn how to configure LibreChat to use Keycloak for user authentication.
|
||
weight: -5
|
||
---
|
||
|
||
# Keycloak
|
||
|
||
1. **Access Keycloak Admin Console:**
|
||
- Open the Keycloak Admin Console in your web browser. This is usually
|
||
found at a URL like `http://localhost:8080/auth/admin/`.
|
||
|
||
2. **Create a Realm (if necessary):**
|
||
- If you don't already have a realm for your application, create one. Click on 'Add Realm' and give it a name.
|
||
|
||
3. **Create a Client:**
|
||
- Within your realm, click on 'Clients' and then 'Create'.
|
||
- Enter a client ID and select 'openid-connect' as the Client Protocol.
|
||
- Set 'Client Authentication' to 'On'.
|
||
- In 'Valid Redirect URIs', enter `http://localhost:3080/oauth/openid/callback` or the appropriate URI for
|
||
your application.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
4. **Configure Client:**
|
||
- After creating the client, you will be redirected to its settings page.
|
||
- Note the 'Client ID' and 'Secret' from the 'Credentials' tab – you'll need these for your application.
|
||
|
||
|
||
|
||
|
||
5. **Add Roles (Optional):**
|
||
If you want to restrict access to users with specific roles, you can define roles in Keycloak and assign them to users.
|
||
- Go to the 'Roles' tab in your client or realm (depending on where you want to define the roles).
|
||
- Create a new role that matches the value you have in `OPENID_REQUIRED_ROLE`.
|
||
|
||
|
||
|
||
6. **Assign Roles to Users (Optional):**
|
||
- Go to 'Users', select a user, and go to the 'Role Mappings' tab.
|
||
- Assign the appropriate role (that matches `OPENID_REQUIRED_ROLE`) to the user.
|
||
|
||
|
||
|
||
7. **Get path of roles list inside token (Optional):**
|
||
- Decode your jwtToken from OpenID provider and determine path for roles list inside access token. For example, if you are
|
||
using Keycloak, the path is `realm_access.roles`.
|
||
- Put this path in `OPENID_REQUIRED_ROLE_PARAMETER_PATH` variable in `.env` file.
|
||
- By parameter `OPENID_REQUIRED_ROLE_TOKEN_KIND` you can specify which token kind you want to use.
|
||
Possible values are `access` and `id`.
|
||
|
||
8**Update Your Project's Configuration:**
|
||
- Open the `.env` file in your project folder and add the following variables:
|
||
```
|
||
OPENID_ISSUER=http://localhost:8080/auth/realms/[YourRealmName]
|
||
OPENID_CLIENT_ID=[YourClientID]
|
||
OPENID_CLIENT_SECRET=[YourClientSecret]
|
||
OPENID_CALLBACK_URL=http://localhost:3080/oauth/openid/callback
|
||
OPENID_SCOPE="openid profile email"
|
||
OPENID_REQUIRED_ROLE=[YourRequiredRole]
|
||
OPENID_REQUIRED_ROLE_TOKEN_KIND=(access|id)
|
||
OPENID_REQUIRED_ROLE_PARAMETER_PATH="realm_access.roles"
|
||
```
|