fix(keycloak) item list

Author: c12simple

knowledge-base/identity_management/oidc_keycloak.md

@@ -15,10 +15,11 @@ weight: 2
 It’s widely trusted for secure authentication in on-premise deployments, enabling organizations to centralize user identity and integrate easily with various services.
 
 This step-by-step guide will help you:
-- Register a new OIDC client in Keycloak.
-- Set up an OIDC Connector in **Pydio Cells**.
-- Map user attributes from Keycloak (using LDAP directory) to user roles in Pydio Cells.
-- Understand how to fix session-related issues and debug your configuration.
+
+* Register a new OIDC client in Keycloak.
+* Set up an OIDC Connector in **Pydio Cells**.
+* Map user attributes from Keycloak (using LDAP directory) to user roles in Pydio Cells.
+* Understand how to fix session-related issues and debug your configuration.
 
 
 ## S1. Register a New OIDC Client in Keycloak
@@ -37,27 +38,30 @@ Clients → Create Client
 ![](../images/connectors/keycloak/create-new-client.png)
 
 **Example values:**
-- **Client ID:** `demo.cells.pydio`
-- **Name:** `Cells Demo`
+
+* **Client ID:** `demo.cells.pydio`
+* **Name:** `Cells Demo`
 
 ![](../images/connectors/keycloak/keycloak-new-client-0.png)
 
 
 **Configure redirect and URLs:**
-- **Root URL:** Pydio Cells URL
-- **Home URL:** Same as above
-- **Valid Redirect URIs:** Callback URL generated by the Connector in Step 2
-- **Valid Post Logout Redirect URIs:** Leave empty
-- **Web Origins:** Pydio Cells URL
+
+* **Root URL:** Pydio Cells URL
+* **Home URL:** Same as above
+* **Valid Redirect URIs:** Callback URL generated by the Connector in Step 2
+* **Valid Post Logout Redirect URIs:** Leave empty
+* **Web Origins:** Pydio Cells URL
 
 ![](../images/connectors/keycloak/keycloak-create-client-3.png)
 
 
 
 **New Client Capability:**
-- **Cells Authentication:** Yes
-- **Authorization:** Off
-- **Authentication Flow:** Standard
+
+* **Cells Authentication:** Yes
+* **Authorization:** Off
+* **Authentication Flow:** Standard
 
 ![](../images/connectors/keycloak/keycloak-new-client-2.png)
 
@@ -79,9 +83,10 @@ Settings → Authentication → OAUTH2/OIDC → Create New Connector
 ```
 
 In the pop-up:
-- **Connector type:** OpenID Connect
-- **ID:** `keycloak` (won't be changed)
-- **Name:** Example: `SSO with Keycloak` (can be customized later)
+
+* **Connector type:** OpenID Connect
+* **ID:** `keycloak` (won't be changed)
+* **Name:** Example: `SSO with Keycloak` (can be customized later)
 
 The **Issuer (Canonical URL)** updates automatically based on the ID. This URL acts as the callback where Keycloak sends tokens after authentication.
 
@@ -94,18 +99,20 @@ Pause here, return to **Step 1**, and add the generated callback URL to the clie
 
 Once you have your **Client ID** and **Client Secret**, continue filling out:
 
-- **Issuer - Canonical URL:**  
-  Format: `https://domain/realms/realm-name`  
-  Example: `https://sso.keycloak.pydio/realms/master`
+* **Issuer - Canonical URL:**  
 
-- **Client ID:** The client ID from Step 1 (`demo.cells.pydio`)
-- **Client Secret:** Copied from Keycloak.
+  - Format: `https://domain/realms/realm-name`  
+  - Example: `https://sso.keycloak.pydio/realms/master`
+
+* **Client ID:** The client ID from Step 1 (`demo.cells.pydio`)
+* **Client Secret:** Copied from Keycloak.
 
 ![](../images/connectors/keycloak/cells-new-connector-3.png)
 
 **Additional options:**
-- **Insecure Skip Email Verified:** Set `On` if using a trusted directory.
-- **Get User Info:** On
+
+* **Insecure Skip Email Verified:** Set `On` if using a trusted directory.
+* **Get User Info:** On
 
 ![](../images/connectors/keycloak/cells-new-connector-4.png)
 
@@ -129,12 +136,13 @@ User Federation → Select LDAP Provider → Mappers → Create Mapper
 ```
 
 Example mapper:
-- **Name:** `memberOf to group`
-- **Mapper type:** `user-attribute-ldap-mapper`
-- **User Model Attribute:** `cellsgroups`
-- **LDAP Attribute:** `memberOf`
-- **Read Only:** On
-- **Always Read Value From LDAP:** On
+
+* **Name:** `memberOf to group`
+* **Mapper type:** `user-attribute-ldap-mapper`
+* **User Model Attribute:** `cellsgroups`
+* **LDAP Attribute:** `memberOf`
+* **Read Only:** On
+* **Always Read Value From LDAP:** On
 
 ![](../images/connectors/keycloak/keycloak-ldap-memberof-mapping.png)
 
@@ -146,22 +154,23 @@ Example mapper:
 Client Scopes → Create Client Scope
 ```
 
-- **Name:** `cellsscope`
-- **Description:** Defines `cellsgroups` claim
+* **Name:** `cellsscope`
+* **Description:** Defines `cellsgroups` claim
 
 ![](../images/connectors/keycloak/keycloak-client-scope-settings.png)
 
 Add a new mapper in the scope:
-- **Mapper Type:** User Attribute
-- **Name:** User Group Mapper
-- **User Attribute:** `cellsgroups`
-- **Token Claim Name:** `cellsgroups`
-- **Claim JSON Type:** string
-- **Add to ID Token:** On
-- **Add to Access Token:** On
-- **Add to Userinfo:** On
-- **MultiValued:** On
-- **Aggregate attribute values:** On
+
+* **Mapper Type:** User Attribute
+* **Name:** User Group Mapper
+* **User Attribute:** `cellsgroups`
+* **Token Claim Name:** `cellsgroups`
+* **Claim JSON Type:** string
+* **Add to ID Token:** On
+* **Add to Access Token:** On
+* **Add to Userinfo:** On
+* **MultiValued:** On
+* **Aggregate attribute values:** On
 
 ![](../images/connectors/keycloak/keycloak-mapping-usermodel-attribute-to-claim.png)
 
@@ -190,8 +199,8 @@ When the user logs in through Keycloak, the ID Token will look like this:
 
 In the Cells Connector configuration, click `+ ADD RULE`:
 
-- **Left Attribute:** `cellsgroups`
-- **Right Attribute:** `Roles`
+* **Left Attribute:** `cellsgroups`
+* **Right Attribute:** `Roles`
 
 ![](../images/connectors/keycloak/cells-mapping-roles.png)
 
@@ -205,9 +214,9 @@ This is often due to a missing **`audience` claim** in the token, which is requi
 
 ## The Root Cause
 
-- After authentication, the client gets an **AccessToken** and **RefreshToken**.
-- By default, the AccessToken expires in ~10 minutes. Near expiry, the client tries to refresh it.
-- If the token is missing an `audience` claim, the refresh request fails, resulting in a forced logout.
+* After authentication, the client gets an **AccessToken** and **RefreshToken**.
+* By default, the AccessToken expires in ~10 minutes. Near expiry, the client tries to refresh it.
+* If the token is missing an `audience` claim, the refresh request fails, resulting in a forced logout.
 
 
 ## How to Test
@@ -251,9 +260,9 @@ cells admin config set "pydio.web.oauth" "staticClients[0]/audience[0]" "https:/
 
 Because there are multiple moving parts between Keycloak and Pydio Cells, start Cells in **debug mode** to:
 
-- See detailed error messages.
-- Inspect full ID Tokens sent by Keycloak.
-- Verify your claim mappings.
+* See detailed error messages.
+* Inspect full ID Tokens sent by Keycloak.
+* Verify your claim mappings.
 
 ## Keep Server Clocks in Sync