Proposal for Keycloak integration

[josephaw1022]

Keycloak MVP

https://www.keycloak.org/server/configuration-production

• Support for configuring Keycloak with external databases (https://www.keycloak.org/server/db)
  • Postgres
  • SQL Server
• Support Keycloak with HTTPS (or behind a reverse proxy with https) (https://www.keycloak.org/server/enabletls)
• OTEL support (https://www.keycloak.org/observability/tracing)
• Add a new sample to aspire-samples shows how to use keycloak for auth

Stretch

• Support for configuring Keycloak realms via the resource builder API (this should work locally and when deployed)
• Integrating Keycloak with Microsoft Entra (https://docs.getvisibility.com/enterprise-setup/authentication/single-sign-on-sso/using-azure-ad-as-keycloak-identity-provider)

Original Issue

Details

I propose adding a Keycloak component to our system for managing authentication and login processes. This integration would be incredibly beneficial, particularly for those using Keycloak, as it would:

• Ensure consistency in different environments.
• Aid in replicating production issues for better troubleshooting.
• Enhance testing capabilities for authentication-related functionalities.

Below is a basic example of how this could be implemented in the program.cs file:

// Example implementation in program.cs

// Adding Keycloak container
var authServer = builder.AddKeyCloakContainer();

// Setting up projects with KeyCloak authentication
var publicSite = builder.AddProject<Projects.PublicSite>().References(authServer);
var postloginSite = builder.AddProject<Projects.PostLoginSite>().References(authServer);

// Additional configurations...

[DamianEdwards]

@josephaw1022 the APIs your example shows are for hosting, not components. Are you suggesting we add both Aspire.Hosting extensions for Keycloak and a Keycloak component?

[josephaw1022]

@DamianEdwards yes! I am currently working on the prometheus and grafana one right now, but I will have a pr for this eventually soon.

[raffaeler]

It's worth noting that Keycloak:

• May expose the admin UI separately from the IP
• Open Telemetry protocol can be turned on (but it's off by default)

[DamianEdwards]

Do you have an example or how to configure Keycloak to use OpenTelemetry, and specifically export via OTLP? When I looked into this the examples I found seemed to rely on an external collector and/or were setup for Prometheus and Jaeger.

I'll look into the option to expose the admin and service endpoints separately too, that's a good thing to ensure we consider.

[raffaeler]

@DamianEdwards

Do you have an example or how to configure Keycloak to use OpenTelemetry, and specifically export via OTLP? When I looked into this the examples I found seemed to rely on an external collector and/or were setup for Prometheus and Jaeger.

Not detailed, but I looked into it because I need to go there for some of my customers.

The latest doc tells that OTEL is supported but must be turned on:
https://www.keycloak.org/keycloak-benchmark/kubernetes-guide/latest/util/otel

The KC_OTEL option is mentioned here: https://www.keycloak.org/keycloak-benchmark/kubernetes-guide/latest/customizing-deployment#KC_OTEL

In my own docker file (which does not include OTEL yet) I customize the Keycloak image using other boolean switches:
https://github.com/raffaeler/authentication/blob/main/docs/install.md#preparing-a-custom-image

In theory, you should just turn on OTEL and instructing Prometheus to get the telemetry from KC.