Single Sign on - Identity Provider - OpenID Connect- Keycloak

[itpjob]

Hi

We are trying to integrate a third party identity provider (Keycloak) with Canvas LMS using OpenID Connect protocol to build Single Sign On. We have looked at https://community.canvaslms.com/docs/DOC-9870-4214406803 to guide us configure it. However, the information is not adequate to configure OpenID Connect related information (please see attached screenshot). Could someone please provide us with step by step instructions on what info/value that we need to provide in the attached fields (listed below as well)

- Client ID

- Client Secret

- Authorize URL

- Token URL

- End Session Endpoint

- UserInfor Endpoint

- scope 

- Login Attribute

- Just in Time provisioning

- Federated attributes

As we are not configuring them correctly (we assume), at the end of request/response, Canvas LMS shows a page where it says that "There was a problem logging in Canvas"

We would be grateful for help.

Kindest Regards

Waker

[kona]

 @itpjob , greetings! You've seemed to have stumped the Community! Were you ever able to get this figured out?

Kona

[lafayette_duart]

Hi there .

Will try to help within my frame of reference ( a fully compliant  oidc/oauth2  identityprovider).
Im using this one:
https://identityserver4.readthedocs.io/en/latest/intro/big_picture.html

this may be of help to understand the terms the fields are asking you.

https://identityserver4.readthedocs.io/en/latest/intro/terminology.html#terminology

In my particular case, integration went quite smooth, since the server fully complies with the protocol  specs.

That information should live somewhere in your authorization service / server ( keycloak).

You will need to figure out where and how to configure your identity provider(idp) in order to fill those fields.

in Keycloak you should be able to create clientID/clientSecret Pair
as for the endpoints, and other data according to keycloak docs you shold be able to look up those values in the metadata document:

The discovery document can be obtained from:

http://${host}:${port}/auth/realms/${realm}/.well-known/uma2-configuration

https://www.keycloak.org/docs/4.8/authorization_services/#_service_authorization_api

scopes in an openid compliant idp may vary.

if you suppress this value, it will ask for the bare minimum (openid)., you could ask for other scopes ( eg: profile, email,your-custom-claim.

More info on resources / claims can be found here:
https://identityserver4.readthedocs.io/en/latest/topics/resources.html

Again, scopes and related claims should be defined / configured on your idp (keycloack)

the login attribute can be the sub claim ( default identifier emitted in an oauth token)

if your idp can emit other claims, you will be able to map them to canvas attributes .

Hope it helps.