Keycloak config

config.json
{
  "oidc_providers": {
    "keycloak": {
      "display_name": "Sign in with keycloak",
      "provider_url": "https://keycloak.example.com/realms/master",
      "client_id": "***",
      "client_secret": "***",
      "redirect_url": "https://semaphore.example.com/api/auth/oidc/keycloak/redirect"
    }
  }
}

Project roles from groups Enterprise

To use group mappings, add a mapper that puts the groups of the user into the ID token:

In the Keycloak Admin Console, open your client, go to Client scopes and open the <client-id>-dedicated scope.
Add a mapper By configuration and choose Group Membership.
Set Token Claim Name to groups and turn on Add to ID token.
Choose how to send the groups with Full group path. When it is on, Keycloak sends the path of each group, for example /devops or /platform/sre, and the group mapping must use this path. When it is off, Keycloak sends only the name of the group, for example sre.

Then set groups_claim for the provider:

config.json
{
  "oidc_providers": {
    "keycloak": {
      "...": "...",
      "groups_claim": "groups"
    }
  }
}

Do not add groups to scopes. Keycloak refuses a scope that it does not know, and the mapper needs no extra scope.

To let users launch Semaphore from the Keycloak Account Console application launcher, enable IdP-initiated login for the provider:

config.json
{
  "oidc_providers": {
    "keycloak": {
      "...": "...",
      "allow_idp_initiated": true
    }
  }
}

Then, in the Keycloak Admin Console, open your client and set the Home URL (Keycloak ≥ 19; older versions call it Base URL) to:

https://semaphore.example.com/api/auth/oidc/keycloak/initiate

When a user clicks the application in the launcher, Keycloak redirects to this URL with the iss parameter. Semaphore validates iss against your provider_url (the realm issuer) and starts a normal Authorization Code flow.