# SSO through OpenID Connect v1 in KeyCloak
# Symptoms

Does Swarmica support SSO through OpenID?

Does Swarmica support SSO through KeyCloak?

# Solution

Yes, SSO through OpenID Connect v1 in KeyCloak is supported.

To do this, you need to configure the Client in KeyCloak and provide access data to Swarmica support:

* REALM (for example, **master**)
* URL (for example, [https://mykeycloak.company.tld](https://mykeycloack.company.tld) )
* CLIENT_ID (for example, **swarmica_app**)
* CLIENT_SECRET (the one that will be generated automatically)

For configuration, follow these steps:

1.  Log in to the KeyCloak admin panel, select Realm (and remember its name - it will be set by Swarmica support as REALM)  > Clients > Create client![](https://support.swarmica.com/attachments/l/v/lvpdwvb_ItMjc2g4_a/Screenshot_2024-12-04_at_21.27.37.png)
2.  Set the name for the client application Client ID (for example, **swarmica_app**) according to the OpenID Connect protocol:![](https://support.swarmica.com/attachments/e/i/ei3JOHhMzdTI8TYh_a/Screenshot_2024-12-04_at_21.29.01.png)
3.  On the next screen, enable Client Authentication:
    ![](https://support.swarmica.com/attachments/_/G/_Gh0nYbY_upVDHYH_a/Screenshot_2024-12-04_at_21.29.37.png)
4.  On the next screen, set the allowed redirect addresses so that your Swarmica instance address is specified. If you have difficulty with which address to specify, contact us for support, we will help.
    For the case when your instance address is **yourinstance.domain.tld** the settings will look like this:
    ![](https://support.swarmica.com/attachments/G/I/GILKoCbgGeCP4XuV_a/Screenshot_2024-12-04_at_21.30.58.png)
5.  Save the changes and in the created client application go to the Credentials tab, set **Client Authenticator** to **Client Id and Secret** and copy the Client Secret:
    ![](https://support.swarmica.com/attachments/7/g/7gV3KRfwaORTIw3v_a/Screenshot_2024-12-04_at_21.31.45.png)
6.  Log in to the Swarmica server via SSH and add the following parameters to the `/root/swarmica/.env` variable:
    * Add `oidc` (in lowercase) to AUTH_PROVIDERS
    * OIDC_DEFAULT_ROLE - user role, if not set - will be CUSTOMER
    * OIDC_REALM_NAME - REALM name in Keycloak
    * OIDC_SERVER_URL - keycloak server, without a slash at the end
    * OIDC_CLIENT_ID - client ID within REALM on Keycloak, set when creating the client
    * OIDC_CLIENT_SECRET - client secret, issued on the Credentials tab inside the Keycloak client
    * OIDC_TIMEOUT - how long to wait for a response from the server, default 30 sec
7. Restart the system:

```txt
docker compose up -d
```