magnolia-module-keycloak-security's Introduction

magnolia-module-keycloak-security

Keycloak SSO/IAM integration for Magnolia 5.5, 5.6

This module delegates authentication - in addition to Magnolias builtin authentication mechanisms - to Keycloak.

Contributions welcome!

Installation

create a client in Keycloak with Direct Access Grants enabled
export the configuration in Keycloak OIDC JSON format from the Installation tab
save the configuration file into your projects classpath, i.e. src/main/resources/keycloak.json
configure src/main/webapp/WEB-INF/config/jaas.config to include the KeycloakAuthenticationModule:

magnolia {
  info.magnolia.jaas.sp.jcr.JCRAuthenticationModule optional realm=system;

  org.sevensource.magnolia.keycloak.security.KeycloakLoginModuleAdapter requisite realm=external skip_on_previous_success=true;
  info.magnolia.jaas.sp.jcr.JCRAuthorizationModule required;
};

for further JAAS configuration options, see

Configuration

All additional configuration is stored in Magnolias JCR.

login into magnolia using the superuser account
go into Configurations App and navigate to /modules/keycloak-security/config and add your keycloakConfigFile, i.e. classpath:keycloak.json
the module features a RoleMapper, which maps Keycloak roles to Magnolia roles. It is configured in /modules/keycloak-security/config/roleMapper.
the module installs a UserManager into /server/security/userManagers/external which can be used as an extension point for customisation

magnolia-module-keycloak-security's People

Contributors

Stargazers

Watchers

magnolia-module-keycloak-security's Issues

DefaultRoleMapper invalid handling of mapUnmappedRolesAsIs

I think

@Override
public String mapRole(String role) {
	final String target = mappings.get(role);
	if(! StringUtils.isEmpty(target)) {
		return target;
	} else {
		return mapUnmappedRolesAsIs ? target : null;
	}
}

should actually be

@Override
public String mapRole(String role) {
	final String target = mappings.get(role);
	if(! StringUtils.isEmpty(target)) {
		return target;
	} else {
		return mapUnmappedRolesAsIs ? role : null;
	}
}