Keycloak signs users in against a realm on a Keycloak server you or your customer runs. It is the self-hosted option in the catalog: the directory stays on your infrastructure while Authdog fronts the application.
Copy the redirect URI
In the Authdog console, select the project and environment, open Authentication > Providers, find Keycloak, and click Enable. Copy the redirect URI shown in the form:
https://identity.authdog.com/api/v1/callback/<connectionId>Create the realm client
- Open the Keycloak admin console and select the realm.
- Under Clients, create a client with Client authentication on — a confidential client.
- Enable the Standard flow (authorization code).
- Under Valid redirect URIs, add the redirect URI from Authdog.
- Save, then copy the Client ID and the secret from the Credentials tab.
- Note the realm base URL — that is the Domain URI.
Configure Authdog
| Field | Value |
|---|---|
| Client ID | The client identifier from the provider |
| Client Secret | The client secret from the provider |
| Domain URI | The realm base URL, e.g. https://keycloak.example.com/realms/acme |
Save, then toggle the connection active.
What Keycloak returns
Authdog requests the openid email profile scopes and reads the profile from the ID token the provider issues.
Claims come from the ID token the realm issues: sub, preferred username, email and its verified flag, and any protocol mappers you configured.
Use the realm base URL as the Domain URI — https://host/realms/<realm> — not the admin console URL and not the full authorize endpoint.
Test it
- Open your environment's hosted sign-in page, or link to
https://identity.authdog.com/api/v1/signin/<connectionId>. - Select the Keycloak button and complete the flow.
- Confirm the user appears under Users in the console with a Keycloak identity linked.
Troubleshooting
| Symptom | Cause |
|---|---|
invalid_client |
The client is public rather than confidential, so it has no secret |
Invalid parameter: redirect_uri |
The URI is missing from the client's valid redirect URIs |
| 404 on authorize | The Domain URI is not the realm base |
| Redirect or callback URL error | The URI registered with the provider does not match Authdog's exactly |
| Works in one environment only | Each environment has its own connectionId, and so its own redirect URI to register |
Related
| Read | To learn how to |
|---|---|
| Connectors | Set up any other social provider |
| Enterprise SSO | Connect Keycloak as a generic OIDC enterprise connection |