Deploying a QA App with Keycloak

This guide assumes you’re following the overall steps here to deploy an app.

When you get to setting environmental variables, you will additionally need to set a couple extra. In the following commands, swap <app-name> for your app’s name.

The values should be provided to you for KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET by course staff.

dokku config:set --no-restart <app-name> KEYCLOAK_ISSUER_URI=https://keycloak-qa.dokku-00.cs.ucsb.edu/realms/cs156-qa
dokku config:set --no-restart <app-name> KEYCLOAK_CLIENT_ID=<provided-value>
dokku config:set --no-restart <app-name> KEYCLOAK_CLIENT_SECRET=<provided-value>
dokku config:set --no-restart <app-name> QA=true

This will provide the necessary credentials for your app for it to interface with keycloak. QA mode informs the app that it should enable this functionality.

Need to issue Keycloak credentials? Look here.

  1. Sign into the appropriate keycloak realm here: https://keycloak-qa.dokku-00.cs.ucsb.edu/admin/cs156-qa/console/
  2. Select “Clients”: image
  3. Select “Create Client”: image
  4. Fill in a client id-this is one students will use, so pick something memorable. Write it down for later.: image
  5. Select “Next”
  6. Enable “Client Authentication” and “Standard Flow”. Everything else should be off: image

  7. Select “Next”

  8. For “Valid Redirect URIs”, fill in the appropriate wildcard or domain. For this example, I’m going to use https://*.dokku-00.cs.ucsb.edu/login/oauth2/code/keycloak. As a note it must end in /login/oauth2/code/keycloak. This is the callback URI configured by us and used by Spring Security. Wildcards should not be used for the dokku-00 production applications and realm. image

  9. Select “Save”

  10. Select “Credentials”, and copy the Client Secret. image

From here, provide the values from Step 4 and Step 10 as KEYCLOAK_CLIENT_ID and KEYCLOAK_CLIENT_SECRET.