Opstella Keycloak Single Sign-On Post-Initialisation Settings

💡 Continue from Keycloak Client Creation.

Keycloak Clients General Customisation Overview

The following is the list of Keycloak Clients that require certain configuration unique to the client.

Tool/Instrument	Client Name	Backchannel logout session required	Backchannel logout revoke offline sessions	Full scope allowed	Exclude Issuer From Authentication Response
ArgoCD	argocd	✅ Yes	✅ Yes	✅ Yes	❌ No
DefectDojo	defectdojo	✅ Yes	❌ No	❌ No	❌ No
SonarQube	sonarqube	✅ Yes	❌ No	✅ Yes	❌ No
GitLab	gitlab	✅ Yes	❌ No	✅ Yes	❌ No
Harbor	harbor	✅ Yes	✅ Yes	✅ Yes	❌ No
Grafana	grafana	✅ Yes	❌ No	✅ Yes	❌ No
Kubernetes API	kubernetes	✅ Yes	❌ No	✅ Yes	❌ No
Vault	vault	✅ Yes	✅ Yes	✅ Yes	❌ No
Opstella	opstella	✅ Yes	❌ No	✅ Yes	✅ Yes

Caution

The Keycloak Clients Customisation here is repetitive, instructions providing here are steps for ONE client.

It is meant for you to REPEAT the steps FOR EACH of Keycloak Client. Please change the configuration value accordingly.

Selecting a Client

1. Go to Clients Panel > Click one of the client (Same name as Client Name) by Client ID column

   Client List

   

   Selected a Client

   

---

Backchannel logout (Logout Settings)

1. Select a Client

2. Go to Logout settings section > Make the switches on/off follow to the table: ✅ Yes: On / ❌ No: Off

   

   Client Name	Logout session required	Revoke offline sessions
   argocd	✅ Yes	✅ Yes
   defectdojo	✅ Yes	❌ No
   sonarqube	✅ Yes	❌ No
   gitlab	✅ Yes	❌ No
   harbor	✅ Yes	✅ Yes
   grafana	✅ Yes	❌ No
   kubernetes	✅ Yes	❌ No
   vault	✅ Yes	✅ Yes
   opstella	✅ Yes	❌ No

---

Full scope allowed

💡 By default, Full scope allowed settings is ✅ Yes: On. Adjust accordingly if necessary.

1. Select a Client that require attention for Full scope allowed

2. Go to Client scopes Tab > selection XYZ-dedicated; where XYZ is the name of client

   

3. Go to Scopes Tab > Make the switches on/off follow to the table: ✅ Yes: On / ❌ No: Off

   

   Client Name	Full scope allowed
   argocd	✅ Yes
   defectdojo	❌ No
   sonarqube	✅ Yes
   gitlab	✅ Yes
   harbor	✅ Yes
   grafana	✅ Yes
   kubernetes	✅ Yes
   vault	✅ Yes
   opstella	✅ Yes

---

Exclude Issuer From Authentication Response

💡 By default, Exclude Issuer From Authentication Response settings is ❌ No: Off. Adjust accordingly if necessary.

1. Select a Client that require attention for Full scope allowed

2. Go to Advanced Tab > Go to OpenID Connect Compatibility Modes

3. Make the switches on/off follow to the table: ✅ Yes: On / ❌ No: Off

   

   Client Name	Exclude Issuer From Authentication Response
   argocd	❌ No
   defectdojo	❌ No
   sonarqube	❌ No
   gitlab	❌ No
   harbor	❌ No
   grafana	❌ No
   kubernetes	❌ No
   vault	❌ No
   opstella	✅ Yes

Keycloak Clients Mapper Configuration Overview

For Keycloak to provide application the permissions of a user correctly, this requires Mapper to be configured.

The following is the list of Keycloak Clients that each section will be its Mapper type.

Caution

The Keycloak Clients Customisation here is repetitive, instructions providing here are steps for ONE client.

It is meant for you to REPEAT the steps FOR EACH of Keycloak Client. Please change the configuration value accordingly.

Group Mapper

• ArgoCD
• SonarQube
• GitLab
• Harbor
• Grafana
• Kubernetes API
• Vault

Audience Mapper

• DefectDojo

Keycloak Clients Mapper Configuration

Group Mapper

Group Mapper

Associate EACH client with Group Membership as groups Token Claim

• Full group path: ❌ No
• Add to ID Token: ✅ Yes
• Add to Access Token: ✅ Yes
• Add to userinfo: ✅ Yes

1. Select a Client that require attention for Full scope allowed

2. Go to Client scopes Tab > selection XYZ-dedicated; where XYZ is the name of client

   

3. Click Add mapper > Click By configuration

   

4. Choose Group Membership

   

5. Configure as follow

   • Full group path: ❌ No
   • Add to ID Token: ✅ Yes
   • Add to Access Token: ✅ Yes
   • Add to userinfo: ✅ Yes

   

Audience Mapper

Audience Mapper

Tool/Instrument	Included Client Audience	Add to ID Token	Add to Access Token
DefectDojo	defectdojo	❌ No	✅ Yes

1. Select a Client that require attention for Full scope allowed

2. Go to Client scopes Tab > selection XYZ-dedicated; where XYZ is the name of client

   

3. Click Add mapper > Click By configuration

   

4. Choose Audience

   

5. Configure as follow

   • Include Client Audience: XYZ ; Adjust accordingly.
   • Add to ID Token: ✅ Yes
   • Add to Access Token: ✅ Yes

   

Group Mapper

Audience Mapper