/
[User management] Identity Provider Configuration Examples

[User management] Identity Provider Configuration Examples

Overview

Keycloak User Login via Third-Party Identity Providers

Integrating third-party Identity Providers with Keycloak requires configuration on both the AGILITY Keycloak side and the external provider.

This guide walks you through adding Okta as an Identity Provider in Keycloak. It covers initial login testing and then details how to set up attribute mappings to automatically populate user data from the Okta token, streamlining user management and improving authentication flow.

Accessing the Admin Console Page

There are two ways to access this page through the AGILITY user interface: via the Application Settings panel or from the top navigation bar menu. Both options will take you to the same destination—choose the one that best fits your workflow.

Application Settings

Users can access the Admin Console page from the Application Settings page within AGILITY:

  1. From the main navigation sidebar, click Applications.

    image-20250505-152744.png
    Main Navigation Menu: Application

  2. Scroll down to locate the Admin Console card.

    image-20250604-142104.png
    Applications: Admin Console Card

  3. Click the Go to Admin Console button—you’ll be redirected to the Admin Console home page.

Top Bar Menu

Users can also access the Admin Console page from the Top Navigation Bar within AGILITY:

  1. From the top navigation bar, click the More button.

    image-20250505-195815.png

  2. Locate the Admin Console from the list.

    image-20250604-143351.png

  3. Click on it to open the feature page—you’ll be redirected to the Admin Console home page.

You may be prompted to authenticate by entering your AGILITY credentials before accessing the Admin Console page.

Okta Identity Provider Configuration

  1. After successfully accessing the AGILITY Admin Console in the previous steps.

  2. Select Configure -> Identity Providers and select OpenID Connect v1.0

    image-20240614-200055.png

  3. Complete the form:

    1. Alias: byond0

    2. Display name: Sign-in with B-Yond

    3. Discovery endpoint: https://idpnew.b-yond.com/.well-known/openid-configuration

    4. Client ID: 0oa4wmwi7n4QouELz4x7

    5. Client Secret: XXXXXXXXXXXXXX

The Client ID and Client Secret are provided by the administrator of the Identity Provider.

image-20240614-200130.png

  1. Click Add to proceed.

    1. Confirm that Okta supports login redirection to:
      https://agility.example.com/cv/auth/realms/agility/broker/byond0/endpoint

    2. Set the logout redirect URL to:
      https://agility.example.com/cv/auth/realms/agility/broker/byond0/endpoint/logout_response

The screenshot shown is for illustrative purposes only. It uses a wildcard for the login URL instead of the full domain.

image-20240614-200151.png

  1. You’re now ready to log in.

    1. Open a new browser window and navigate to the application home page:
      https://agility.example.com/cv/

    2. Click "Sign in with B-Yond".

      image-20240614-200214.png

    3. On your first login, you’ll be prompted to Update Account Information.

      image-20240614-200231.png

    4. Fill in the required details and click Submit to complete the process.

      image-20240614-200250.png

Account Information Configuration

The Update Account Information prompt during first login can be resolved by configuring the correct attribute mappings.

  1. Complete the steps outlined in the Accessing the Admin Console section.

  2. Navigate to Configure → Identity Providers → Sign in with B-Yond → Advanced tab.

  3. Ensure the Requested Scopes field includes at least the following values:
    openid profile groups

    image-20240614-200323.png

  4. Click Save to apply your changes.

  5. Then, go to the Mappers tab and click Add Mapper to begin configuring attribute mappings.

    image-20240614-200348.png

  6. Create mappers for the following user attributes: firstName, lastName, username, and email.

    1. firstName

      image-20240614-200508.png

    2. lastName

      image-20240614-200518.png

    3. username

      image-20240614-200526.png

    4. email

      image-20240614-200532.png

       

To avoid being prompted to update account information during login, either remove the existing local user or test with a new user from Okta. This ensures Keycloak pulls fresh attribute mappings during the first login.

⚠️ Notes on Sharing Email Addresses Between Local and Identity Provider Users

By default, duplicate email addresses are not allowed in Keycloak. Users must choose between logging in as a local user or via an identity provider.

If the same email address is used for both, it may cause user conflicts unless email verification is properly configured.

When email is correctly set up, users will be prompted to verify their email address, allowing Keycloak to safely merge the user accounts and avoid duplication issues.

image-20240614-200622.png

Social Network Configuration

Social networks can also serve as Identity Providers in Keycloak. This section provides a brief overview of how to configure social login within Keycloak, but does not cover the setup or configuration details specific to each social network provider.

Google

Make sure the following options are configured correctly:

Client ID: 218140556172-8j4oul55XXXXXXXXXjqndgqep1.apps.googleusercontent.com Client Secret: XXXXXXXXX Display Order: 1 Request refresh token: On
image-20240614-200641.png

LinkedIn OpenID Connect

Ensure that the requested scopes include at minimum: openid, profile, and email.

Client ID: 868jXXXXXc4 Client Secret: XXXXXXXXX Display Order: 2
image-20240614-200655.png

Update the Authentication Flow to Enforce Login via Identity Provider

Prerequisite: You must have Keycloak general admin user access.

  1. Obtain the Keycloak general admin password.

  2. Access the Keycloak Admin Console by using the kubectl port-forward method to forward the necessary port.

  3. Confirm you are operating within the agility realm.

  4. Navigate to Configure → Authentication.

  5. In the Flow Name column, locate and select browser.

  6. Find the Identity Provider Redirector row and click the settings (gear) icon to open its configuration.

    image-20240614-200745.png

  7. In the form that appears:

    • Enter the Alias.

    • Set the Default Identity Provider to the alias of the identity provider you created earlier (e.g., byond0).

      image-20240614-200800.png

  8. Click Save to apply the changes.