# Keycloak 单点登录提供商

> Source: https://strapi.nodejs.cn/cms/configurations/sso-providers/keycloak

🌐 Keycloak (OpenID Connect) provider SSO configuration

Keycloak 是一个 OpenID Connect 单点登录提供程序，允许用户通过在 `config/admin` 中配置的 `passport-keycloak-oauth2-oidc` 策略使用 Keycloak 身份验证登录 Strapi。

🌐 Keycloak is an OpenID Connect SSO provider that lets users sign in to Strapi through Keycloak authentication using the `passport-keycloak-oauth2-oidc` strategy configured in `config/admin`.

本页面解释了如何为[单点登录 (SSO) 功能](/cms/features/sso) 设置 Keycloak 提供程序。

🌐 The present page explains how to setup the Keycloak provider for the [Single Sign-On (SSO) feature](/cms/features/sso).

:::prerequisites

你已阅读[如何配置 SSO 指南](/cms/configurations/guides/configure-sso)。

🌐 You have read the [How to configure SSO guide](/cms/configurations/guides/configure-sso).

:::

## 安装 {#installation}

🌐 Installation

安装 [passport-keycloak-oauth2-oidc](https://www.npmjs.com/package/passport-keycloak-oauth2-oidc)：

```sh
yarn add passport-keycloak-oauth2-oidc
```

```sh
npm install --save passport-keycloak-oauth2-oidc
```

## 配置示例 {#configuration-example}

🌐 Configuration example

Keycloak SSO 提供程序在 [ `config/admin` 文件](/cms/configurations/admin-panel) 的 `auth.providers` 数组中配置：

🌐 The Keycloak SSO provider is configured in the `auth.providers` array of [the `config/admin` file](/cms/configurations/admin-panel):

```js title="/config/admin.js"

const KeyCloakStrategy = require("passport-keycloak-oauth2-oidc");

module.exports = ({ env }) => ({
  auth: {
    // ...
    providers: [
      {
        uid: "keycloak",
        displayName: "Keycloak",
        icon: "https://raw.githubusercontent.com/keycloak/keycloak-admin-ui/main/themes/keycloak/logo.svg",
        createStrategy: (strapi) =>
          new KeyCloakStrategy(
            {
              clientID: env("KEYCLOAK_CLIENT_ID", ""),
              realm: env("KEYCLOAK_REALM", ""),
              publicClient: env.bool("KEYCLOAK_PUBLIC_CLIENT", false),
              clientSecret: env("KEYCLOAK_CLIENT_SECRET", ""),
              sslRequired: env("KEYCLOAK_SSL_REQUIRED", "external"),
              authServerURL: env("KEYCLOAK_AUTH_SERVER_URL", ""),
              callbackURL:
                strapi.admin.services.passport.getStrategyCallbackURL(
                  "keycloak"
                ),
            },
            (accessToken, refreshToken, profile, done) => {
              done(null, {
                email: profile.email,
                username: profile.username,
              });
            }
          ),
      },
    ],
  },
});
```

```ts title="/config/admin.ts"

  auth: {
    // ...
    providers: [
      {
        uid: "keycloak",
        displayName: "Keycloak",
        icon: "https://raw.githubusercontent.com/keycloak/keycloak-admin-ui/main/themes/keycloak/logo.svg",
        createStrategy: (strapi) =>
          new KeyCloakStrategy(
            {
              clientID: env("KEYCLOAK_CLIENT_ID", ""),
              realm: env("KEYCLOAK_REALM", ""),
              publicClient: env.bool("KEYCLOAK_PUBLIC_CLIENT", false),
              clientSecret: env("KEYCLOAK_CLIENT_SECRET", ""),
              sslRequired: env("KEYCLOAK_SSL_REQUIRED", "external"),
              authServerURL: env("KEYCLOAK_AUTH_SERVER_URL", ""),
              callbackURL:
                strapi.admin.services.passport.getStrategyCallbackURL(
                  "keycloak"
                ),
            },
            (accessToken, refreshToken, profile, done) => {
              done(null, {
                email: profile.email,
                username: profile.username,
              });
            }
          ),
      },
    ],
  },
});
```