Configuring Keycloak OAuth with Thinfinity

Configuring Keycloak OAuth with Thinfinity

Keycloak Configuration

1. In your Keycloak Administration console, navigate to Clients -> Create Client -> Client type -> “OpenID Connect”


Configure the following parameters as shown:


Client ID: MyKeycloakOauthConnector
Root URL: https://MyThinfinity.com:8443
Valid redirect URIs: https://MyThinfinity.com:8443/*



2. Scroll down to the next section, and select: Client Authentication -> ON Authentication Flow -> Standard flow + Direct access grants


3. Next, click on Credentials and select Client ID and Secret.


4. Verify the Client Scope you want to use. In this example, we are going to use "openid".



5. Obtain Keycloak’s OpenID Endpoint configuration by navigating to Realm Settings and clicking on OpenID Endpoint Configuration.


We are going to need the “authorization_endpoint” , the “token_endpoint”, and the “end_session_endpoint”.


Thinfinity Workspace Configuration

1. Add an authentication method: Open the Thinfinity/Settings menu, navigate to Authentication Methods, and click Add.


Fill the following fields:
Name: MyKeycloakOauthConnector
Virtual Path: MyKeycloakOauthConnector
Client ID: MyKeycloakOauthConnector
Client Secret: enter the Client Secret obtained from Keycloak
Enabled: set to -> True

2. Then click on the Server dropdown table, and configure the following fields:


  1. Paste the “authorization_endpoint” obtained from the OpenID Configuration Endpoint
  2. Type in “scope=openid”
  3. Paste the “token_endpoint” obtained from the OpenID Configuration Endpoint
  4. Paste the “end_session_endpoint” obtained from the OpenID Configuration Endpoint
  5. Check “Get from Token”
  6. Type in “1”
  7. Type in “preferred_username” Click Save.
3. Configure external/internal user mappings In Thinfinity Workspace Settings menu, navigate to Authentication/Identity Mappings and click Add.


In the ID Pattern field select which Keycloak User you want to map to the internal Windows local computer/domain user.