Keycloak SSO

Follow the sections in this guide to set up Keycloak SSO.

Create Server Credentials

Step 1: Access the Keycloak Admin Console

• You need an administrator account. If you don't have, see Creating the first administrator.
• Go to the URL for the Admin Console. For example, for localhost, use this URL: http://localhost:8080/admin/

• Enter the username and password you created.

Step 2: Change Realm selected

• The Keycloak use Realms as the primary form of organization, we can't use the realm "master" for new clients (apps), only for administration, so change for your specific realm or create a new.
• In this example we are used an existing one called "Data-sec".

Step 3: Create OpenMetadata as a new Client

• Click on Clients in the menu.
• Click on Create button.
• Enter the Client ID and Protocol as the image.
• Click on Save button.

Step 4: Edit settings of the client

• Change "Access Type" value from "public" to "confidential".
• Change "implicit flow" and "service accounts" to enabled.

• At the bottom of the same settings page, change the configurations to the openmetadata address.
• The image below shows different possibilities, such as running locally or with a custom domain.

• Click on Save button.

Step 5: Where to Find the Credentials

• Navigate to the Credentials tab.
• You will find your Client Secret related to the Client id "open-metadata"

After the applying these steps, the users in your realm are able to login in the openmetadata, as a suggestion create a user called "admin-user". Now you can update the configuration of your deployment:

Configure Ingestion

Once your server security is set, it's time to review the ingestion configuration. Our bots support JWT tokens to authenticate to the server when sending requests.

Find more information on Enabling JWT Tokens and JWT Troubleshooting to ensure seamless authentication.