> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Keycloak OIDC Overview

> Learn how to configure Keycloak OIDC for Infisical SSO.

<Info>
  Keycloak OIDC SSO is a paid feature. If you're using Infisical Cloud, then it
  is available under the **Pro Tier**. If you're self-hosting Infisical, then
  you should contact [sales@infisical.com](mailto:sales@infisical.com) to purchase a self-hosted license to
  use it.
</Info>

<Note>
  SSO authentication requires [Email Domain Verification](/documentation/platform/email-domain).
  You must verify your organization's email domain before users can log in via SSO.
</Note>

<Steps>
  <Step title="Create an OIDC client application in Keycloak">
    1.1. In your realm, navigate to the **Clients** tab and click **Create client** to create a new client application.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/clients-list.png" alt="OIDC keycloak list of clients" />

    <Info>
      You don’t typically need to make a realm dedicated to Infisical. We recommend adding Infisical as a client to your primary realm.
    </Info>

    1.2. In the General Settings step, set **Client type** to **OpenID Connect**, the **Client ID** field to an appropriate identifier, and the **Name** field to a friendly name like **Infisical**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/create-client-general-settings.png" alt="OIDC keycloak create client general settings" />

    1.3. Next, in the Capability Config step, ensure that **Client Authentication** is set to On and that **Standard flow** is enabled in the Authentication flow section.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/create-client-capability.png" alt="OIDC keycloak create client capability config settings" />

    1.4. In the Login Settings step, set the following values:

    * Root URL: `https://app.infisical.com`.
    * Home URL: `https://app.infisical.com`.
    * Valid Redirect URIs: `https://app.infisical.com/api/v1/sso/oidc/callback`.
    * Web origins: `https://app.infisical.com`.

          <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/create-client-login-settings.png" alt="OIDC keycloak create client login settings" />

    <Info>
      If you’re self-hosting Infisical, then you will want to replace [https://app.infisical.com](https://app.infisical.com) (base URL) with your own domain.
    </Info>

    1.5. Next, navigate to the **Client scopes** tab and select the client's dedicated scope.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/client-scope-list.png" alt="OIDC keycloak client scopes list" />

    1.6. Next, click **Add predefined mapper**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/client-scope-mapper-menu.png" alt="OIDC keycloak client mappers empty" />

    1.7. Select the **email**, **given name**, **family name** attributes and click **Add**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/scope-predefined-mapper-1.png" alt="OIDC keycloak client mappers predefined 1" />

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/scope-predefined-mapper-2.png" alt="OIDC keycloak client mappers predefined 2" />

    Once you've completed the above steps, the list of mappers should look like the following:

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/client-scope-complete-overview.png" alt="OIDC keycloak client mappers completed" />
  </Step>

  <Step title="Retrieve Identity Provider (IdP) Information from Keycloak">
    2.1. Back in Keycloak, navigate to Configure > Realm settings > General tab > Endpoints > OpenID Endpoint Configuration and copy the opened URL. This is what is to referred to as the Discovery Document URL and it takes the form: `https://keycloak-mysite.com/realms/myrealm/.well-known/openid-configuration`.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/realm-setting-oidc-config.png" alt="OIDC keycloak realm OIDC metadata" />

    2.2. From the Clients page, navigate to the Credential tab and copy the **Client Secret** to be used in the next steps.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/client-secret.png" alt="OIDC keycloak realm OIDC secret" />
  </Step>

  <Step title="Finish configuring OIDC in Infisical">
    3.1. Back in Infisical, head to the **Single Sign-On (SSO)** page and select the **General** tab. Click **Connect** for **OIDC**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/connect-oidc.png" alt="OIDC SSO Connect" />

    3.2. For configuration type, select Discovery URL. Then, set the appropriate values for **Discovery Document URL**, **JWT Signature Algorithm**, **Client ID**, and **Client Secret**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/keycloak-oidc/create-oidc.png" alt="OIDC keycloak paste values into Infisical" />

    <Info>
      Currently, the following JWT signature algorithms are supported: RS256, RS512, HS256, and EdDSA
    </Info>

    Once you've done that, press **Update** to complete the required configuration.
  </Step>

  <Step title="Enable OIDC SSO in Infisical">
    Enabling OIDC SSO allows members in your organization to log into Infisical via Keycloak.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/enable-oidc.png" alt="OIDC keycloak enable OIDC" />
  </Step>

  <Step title="Enforce OIDC SSO in Infisical">
    Enforcing OIDC SSO ensures that members in your organization can only access Infisical
    by logging into the organization via Keycloak.

    To enforce OIDC SSO, you're required to test out the OpenID connection by successfully authenticating at least one Keycloak user with Infisical.
    Once you've completed this requirement, you can toggle the **Enforce OIDC SSO** button to enforce OIDC SSO.

    <Warning>
      We recommend ensuring that your account is provisioned using the application in Keycloak
      prior to enforcing OIDC SSO to prevent any unintended issues.
    </Warning>

    <Info>
      In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. [https://app.infisical.com/login/admin](https://app.infisical.com/login/admin).
    </Info>
  </Step>
</Steps>

<Tip>
  If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](/documentation/platform/admin-panel/server-admin#default-organization) to expedite OIDC login.
</Tip>

<Note>
  If you're configuring OIDC SSO on a self-hosted instance of Infisical, make
  sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to
  work:

  <div class="height:1px;" />

  * `AUTH_SECRET`: A secret key used for signing and verifying JWT. This
    can be a random 32-byte base64 string generated with `openssl rand -base64
        32`.

  <div class="height:1px;" />

  * `SITE_URL`: The absolute URL of your self-hosted instance of Infisical including the protocol (e.g. [https://app.infisical.com](https://app.infisical.com))
</Note>