Skip to main content

6. Concert OIDC Setup

In this section, you will configure Concert to use Keycloak as its OpenID Connect (OIDC) identity provider. This enables Single Sign-On for Concert, allowing users to authenticate with their LDAP credentials through Keycloak.

6.1: Understanding OIDC Integration​

OpenID Connect (OIDC) is an authentication protocol built on top of OAuth 2.0. It allows applications like Concert to delegate authentication to an identity provider like Keycloak.

6.1.1: OIDC Authentication Flow​

  1. User Access: User navigates to Concert and clicks "Login with SSO"
  2. Authorization Request: Concert redirects user to Keycloak with an authorization request
  3. User Authentication: User authenticates with Keycloak (which validates against LDAP)
  4. Authorization Grant: Keycloak redirects back to Concert with an authorization code
  5. Token Exchange: Concert exchanges the code for an ID token and access token
  6. User Info: Concert validates the token and retrieves user information
  7. Session Creation: Concert creates a session and grants access

6.2: Setup the default role for all imported users​

Now, we will setup the default role for all OpenLDAP imported users.
The default role ensures that every LDAP-imported user gets a minimum baseline access level in Concert i.e. User role so that no authenticated user is ever left with an empty role claim in their token — which would cause Concert to deny them access entirely.

6.2.1: Navigate to Clients​

  1. In the Keycloak Admin Console, ensure you're in the concert-realm realm (check the realm dropdown)
  2. Click Realm Roles from the left navigation menu.
  3. Check if the role default-roles-concert-realm already exists for your Realm.
  4. Click on default-roles-concert-realm to list all the roles for user realm.

Concert Realm Default Roles

  1. Click Assign role dropdown list and select Client Roles

Concert Realm Assign User

  1. Search for User
  2. Select User role and click Assign.

Default Roles

  1. Finally, you should see User role is added in the list.

User Role Added

6.3: Configure a User with Admin Role for Concert Instance level​

Concert has 2 levels of role-based access: Instance level access and Object level access.

With Instance level Role access, user with Admin or User role can perform the following actions:

Instance level RoleDetails
AdminGrant or revoke access to other users or user groups (except for the Owner role)
Create, edit, delete, and run ingestion jobs
View, use, create, update, and delete shared third-party credentials (connections)
Define applications and environments
UserView ingestion jobs
View and use shared third-party credentials (connections)
Define applications and environments

In this section, we will assign Admin role to alice user for Concert instance level access. Other users will have User role for instance level access. We will explore object level access and role assignment in section 7.

  1. In the Keycloak Admin Console, ensure you're in the concert-realm realm (check the realm dropdown)
  2. Click Users from the left navigation menu.
  3. Enter alice in the search box, next to magnifying glass, and click Return key

Search User Alice

  1. You should see one user: alice
  2. Click on alice to open user details page
  3. Click on the Role Mappings tab

User Alice Role Mapping

  1. For Assign role dropdown, select Client Roles and then select Admin under Name column and concert-client under Client ID column

Assign Alice Admin Role

  1. Now, you should see Admin role is added in the list of assigned roles for alice user.
  2. Next, remove default-roles-concert-realm role from alice user by selecting default-roles-concert-realm role in the list of assigned roles.
  3. Click the ⋮ (three vertical dots) far right on same row as default-roles-concert-realm role to make Unassign visible.
  4. Click Unassign to unassign the role from alice user. This step is required because the default role assigned to all users is set to User and it will override the client role assignment. Unassign the default role will allow the Admin role to take effect.

Unassign Default Role

  1. Leave the other users bob and charlie with the default-roles-concert-realm role for Concert instance level access.

Bob User Role Mapping

Charlie User Role Mapping

info

Repeat steps 3-11 for other users if you want to assign them with the Admin role for Concert instance level access.

We will validate this role assignment for Concert Instance level in Section 7 when we test the SSO login to Concert UI with alice user.

6.4 : Verify Token Claims​

Before testing the actual login, let's verify that Keycloak will include the correct user information in the authentication tokens.

  1. Go back to Clients → concert-client
  2. Click the Client scopes tab
  3. Click Evaluate
  4. In the User field, type alice and select the user
  5. Click Generated access token tab
  6. You should see the token payload including:

Token Evaluation

Actual output in payload section
{
  "exp": 1782133013,
  "iat": 1782132713,
  "jti": "onrtna:4b1020a6-6975-02a4-d141-36d9a136ab55",
  "iss": "https://concert.ibmdte.local:13443/sys/internal/kc/realms/concert-realm",
  "aud": "account",
  "sub": "d5659585-1fc3-4fa5-afea-c36125755275",
  "typ": "Bearer",
  "azp": "concert-client",
  "sid": "99c2b194-1c3f-a182-c086-d377a834631f",
  "acr": "1",
  "realm_access": {
    "roles": [
      "offline_access",
      "uma_authorization",
      "default-roles-concert-realm"
    ]
  },
  "resource_access": {
    "concert-client": {
      "roles": [
        "Admin"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "openid groups email profile",
  "email_verified": false,
  "name": "Alice Admin Admin",
  "groups": [
    "corporate_it_staff"
  ],
  "preferred_username": "alice",
  "given_name": "Alice Admin",
  "family_name": "Admin",
  "email": "alice@example.com"
}

6.5: Concert SSO Login Button​

After running setup-keycloak script in Section 5.2, Concert should display an SSO login option on the login page.

6.5.1: Verify SSO Login Option​

  1. From the Bastion Host, open Firefox
  2. Navigate to Concert UI: https://concert.ibmdte.local:12443/concert/
  3. You should now see Login with SSO (new OIDC login button)

SSO Login Button

note

If you don't see the SSO login button:

  • Verify OIDC configuration was applied correctly
  • Check Concert pods have restarted
  • Clear browser cache and reload the page

6.6: Configuration Summary (revisit for Concert v3.0.0)​

You have successfully configured Concert OIDC integration with:

Keycloak Client Configuration​

  • ✅ Created concert-client in Keycloak
  • ✅ Configured as confidential client with authorization code flow
  • ✅ Set valid redirect URIs for Concert
  • ✅ Retrieved and secured client secret

Client Scopes and Mappers​

  • ✅ Configured group membership mapper
  • ✅ Enabled groups claim in tokens
  • ✅ Verified token claims include user groups

Concert OIDC Configuration​

  • ✅ Created OIDC configuration secret
  • ✅ Created OIDC configuration ConfigMap
  • ✅ Updated Concert deployment with OIDC settings
  • ✅ Configured role mappings for Concert personas

Verification​

  • ✅ Concert pods have restarted with new configuration
  • ✅ SSO login button visible on Concert login page
  • ✅ OIDC provider initialized successfully

Troubleshooting​

info

This section provides basic troubleshooting steps in case you encounter any issues while performing the steps above. These steps are optional and only need to be followed if you run into problems.

SSO Login Button Not Appearing​

Problem: Concert login page doesn't show SSO option

Solutions:

  • Check Concert pods state whether healthy or not
  • Clear browser cache and reload page

Invalid Client Error​

Problem: Login fails with "Invalid client" error

Solutions:

  • Verify client ID matches in both Keycloak and Concert configuration
  • Check client is enabled in Keycloak
  • Verify redirect URIs are correctly configured in Keycloak client
  • Ensure Concert URL matches the configured redirect URI

Groups Not in Token​

Problem: Users authenticate but don't get correct roles

Solutions:

  • Verify group membership mapper is configured in Keycloak
  • Check mapper is added to the correct client scope
  • Evaluate token in Keycloak to verify groups claim is present
  • Ensure users are members of LDAP groups
  • Re-sync LDAP groups in Keycloak

Role Mapping Not Working​

Problem: Users authenticate but have wrong permissions in Concert

Solutions:

  • Verify role mapping configuration in Concert OIDC config
  • Check group names match exactly (case-sensitive)
  • Ensure Concert role names are correct (Admin, User)
  • Review Concert logs for role assignment messages
  • Test with different users to isolate the issue

Redirect Loop​

Problem: Login redirects back and forth between Concert and Keycloak

Solutions:

  • Verify redirect URIs are correctly configured
  • Check for trailing slashes in URLs (should be consistent)
  • Clear browser cookies and cache
  • Verify Concert callback endpoint is accessible
  • Check for proxy or load balancer configuration issues

Next Steps​

Now that Concert is configured to use Keycloak for OIDC authentication, you're ready to test the complete SSO flow. In the next section, you'll:

  • Test SSO login with different user personas
  • Verify role-based access control
  • Validate the complete authentication chain from Concert → Keycloak → OpenLDAP
  • Troubleshoot any authentication issues
success

Concert OIDC setup is complete! Concert is now ready to authenticate users via Keycloak SSO.