How to replace keycloak with Anyother SSO in Microcks

[sathishsoft2409]

I have done it in service but i need to do it in UI please help on this

[lbroudoux]

Hi @sathishsoft2409
Replacing Keycloak with another SSO is not planned at the moment and I don't know how to do this. Could you explain why you'd like to do this?

Do you know that Keycloak can be used as an Identity broker for other SSO solutions? We have users in the community who are using it in combination with Azure AD or Social Identity brokering. It's just a matter of configuring it that way. See https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_broker

[lbroudoux]

Have you considered integrating both like describe in https://scureq.medium.com/forgerock-identity-management-and-keycloak-as-an-identity-provider-why-not-17182e1b5887 ? Keycloak can be truly transparent and that way you can still use it to have Microcks manage its group memberships.

[sathishsoft2409]

@lbroudoux

As look into this, It is doing auth via keycloak to forgerock but our requirement is we have a SSO url provided by our organization so we need to redirect microck application to the particular SSO url. we do not need to use any intermediate here.
Also i done the changes from service layer, but while trying to follow the step in the below URL
https://backstage.forgerock.com/docs/sdks/latest/sdks/integrations/build-protected-angular-web-app.html
in UI I can see lot of error because of low version of angular. I tried to update Angular version but lot of dependency is missing. Please suggest some idea to replace keycloak from UI

[lbroudoux]

I didn't go through the whole post I admit. But from my experience, using Keycloak this way can be totally transparent as it can redirect to other provider directly. That way you don't even see the Keycloak UI, you're just using the target provider UI.

For that, your external provider must be configured as the only one available.

[sathishsoft2409]

@lbroudoux Thanks i got you it is worked. But there is an issue in Microcks authetication with keycloak Please have a look on below issue

#1232

[lbroudoux]

Hey @sathishsoft2409
I don't see any update on the issue #1232 . Did you collect the Kecyloak server logs to guess the origin of the 401 response?

[sgkiokas]

Hi @lbroudoux ! Is the migration to another SSO still not planned? We are interested in keeping only Azure AD and not having to maintain another solution when deploying Microcks with K8S Operators on EKS, so I wanted to see if the plans remain the same from your side.

[lbroudoux]

We have hard dependencies on Keycloak, and - if we wanted to - they wouldn't be easily removed.

The nice thing about putting Keycloak in the mix is that we don't have to care about all the subtle differences that exist between all the different Authorization servers...

Do you know that Keycloak can be used as a bridge/broker for other identity solutions? We have users in the community who are using it in combination with Azure AD or Social Identity brokering. It's just a matter of configuring it that way. See https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_broker.

I agree that it's an additional pod to deploy, but once configured to connect to your identity provider, it is totally transparent to users and can be considered as a black box. The fact is that Keycloak brings a lot of flexibility and allows for a greater choice of providers -we certainly cannot support in Microcks.

[sgkiokas]

Thanks for the prompt reply as always @lbroudoux !