Integrating Keycloak with Alfresco - alfresco

Question

I Use Alfresco in my spring boot Application. I wanted to use authentication subsystem(identity-service). i have given configurations to use in alfresco-global.properties.
It is not connecting to Keycloak. No errors found in log. I could find in logs Authentication subsystem starts though.
[ restartedMain] a.i.IdentityServiceDeploymentFactoryBean : Keycloak JWKS URL: http://localhost:8011/auth/realms/alfresco-dbp/protocol/openid-connect/certs
2019-10-24 16:41:34.956 INFO --- [ restartedMain] a.i.IdentityServiceDeploymentFactoryBean : Keycloak Realm: alfresco-dbp
2019-10-24 16:41:34.956 INFO --- [ restartedMain] a.i.IdentityServiceDeploymentFactoryBean : Keycloak Client ID: alfresco-client
2019-10-24 16:41:34.958 INFO --- [ restartedMain] o.a.r.m.s.ChildApplicationContextFactory : Startup of 'Authentication' subsystem, ID: [Authentication, managed, identity-service1] complete

Answer 1

Alfresco provides Identity Service for SSO. I have integrated Alfresco 6.2.2 with Identity Service 1.3. It is working fine.
But still if you want to implement standalone keycloak independently, it will work with same configuration. I have tested with keycloak 9.0.3 and keycloak 11.0.0 (which is the underlying version of Identity Service 1.3) - both integrated with Alfresco, and working correctly.
The configuration in alfresco files would remain the same :
Below are the alfresco-global.properties settings. Keycloak is assumed to be running on port 8081:
authentication.chain=identity-service-1:identity-service,alfrescoNtlm-1:alfrescoNtlm
identity-service.auth-server-url=http://localhost:8081/auth
identity-service.enable-basic-auth=true
identity-service.realm=sharerealm
identity-service.resource=alfresco
csrf.filter.referer=http://localhost:8080
csrf.filter.origin=http://localhost:8080/*
aims.enabled=true
aims.realm=sharerealm
aims.resource=alfresco
aims.authServerUrl=http://localhost:8081/auth
aims.publicClient=true
Entry in share-config-custom.xml file:
<!-- AIMS -->
<config evaluator="string-compare" condition="AIMS">
<enabled>true</enabled>
<realm>sharerealm</realm>
<resource>alfresco</resource>
<authServerUrl>http://localhost:8081/auth</authServerUrl>
<sslRequired>none</sslRequired>
<publicClient>true</publicClient>
<autodetectBearerOnly>true</autodetectBearerOnly>
<alwaysRefreshToken>true</alwaysRefreshToken>
<principalAttribute>email</principalAttribute>
<enableBasicAuth>true</enableBasicAuth>
</config>
If you are working with ADF or ADW (Alfresco Digital Workspace), then the following entry in app.config.json:
"$schema": "../node_modules/#alfresco/adf-core/app.config.schema.json",
"ecmHost": "http://localhost:8080",
"aosHost": "http://localhost:8080/alfresco/aos",
"baseShareUrl": "http://localhost:8080/adw",
"providers": "ECM",
"authType": "OAUTH",
"oauth2": {
"host": "http://localhost:8081/auth/realms/sharerealm",
"clientId": "alfresco",
"scope": "openid",
"secret": "",
"implicitFlow": true,
"silentLogin": true,
"publicUrls": [
"**/preview/s/*",
"**/settings"
],
"redirectSilentIframeUri": "http://localhost:8080/adw/assets/silent-refresh.html",
"redirectUri": "/adw",
"redirectUriLogout": "/adw/#/login"
},