Keycloak | 身份提供商
用 Keycloak 登录 Casdoor
Already run Keycloak? Add it to Casdoor as an OpenID Connect provider and people sign in to your Casdoor applications with their Keycloak accounts, while Casdoor handles the rest: other social logins, MFA, applications and permissions.
https://auth.example.com 请换成你的 Casdoor 地址（Casdoor 云上类似 https://acme.casdoor.com），其他 example.com 地址也换成你自己的。用 Casdoor 配置 Keycloak
- 1
Create a client in Keycloak
In the Keycloak admin console, switch to the
myrealmrealm, open Clients and click Create client. Choose OpenID Connect as the client type, enter a client ID such ascasdoor, and click Next. - 2
Turn on client authentication
Turn Client authentication on and keep Standard flow enabled, click Next, and fill in the login settings:
Valid redirect URIs https://auth.example.com/callback - 3
Copy the client secret
Save the client, open its Credentials tab and copy the Client secret. The client ID is the one you entered.
- 4
在 Casdoor 中添加 Keycloak 提供商
在 Casdoor 控制台打开 提供商，点击 添加，填写：
类别 OAuth 类型 OIDC 显示名称 Keycloak 客户端ID <client ID> 客户端密钥 <client secret> Issuer链接 https://keycloak.example.com/realms/myrealm 认证URL https://keycloak.example.com/realms/myrealm/protocol/openid-connect/auth Token链接 https://keycloak.example.com/realms/myrealm/protocol/openid-connect/token 范围 openid profile email UserInfo链接 https://keycloak.example.com/realms/myrealm/protocol/openid-connect/userinfo 登出URL https://keycloak.example.com/realms/myrealm/protocol/openid-connect/logout 启用PKCE 开启 点击 Issuer链接 旁边的 请求，会从 Keycloak 的 discovery 文档自动填好其余地址。同一个组织里所有 OIDC 类型的提供商都通过同一个字段关联用户，所以如果这个组织已经有一个 OIDC 提供商，请把 类型 改成 Custom Flexible，它按提供商分别关联账号。
- 5
把提供商加到应用上
打开 应用，编辑用户登录的那个应用，在它的 提供商 标签页添加这个提供商。之后登录页上就会出现 Keycloak 按钮。
注意事项
- Keycloak matches redirect URIs exactly, so enter the Casdoor address people actually use, and avoid wildcards.
- Casdoor links each account to the Keycloak user ID (
sub), so renaming a user in Keycloak doesn't create a second Casdoor account.
Keycloak 的设置取自它的官方文档（核对于 2026年10月：Keycloak OpenID Connect endpoints、Keycloak getting started）。Keycloak 是其所有者的商标。
常见问题
My Keycloak URLs have /auth in them. Does this still work?
Yes. Keycloak 16 and older put /auth in front of every path; include it in the Keycloak URL, for example https://keycloak.example.com/auth.
Can I use SAML instead?
Casdoor also has a Keycloak SAML provider. OpenID Connect needs less setup on both sides, which is why this template uses it.
更多身份提供商
查看全部
Authelia
身份提供商Let people sign in to Casdoor through Authelia over OpenID Connect: the provider settings, and the client to add to Authelia's configuration.
authentik
身份提供商Let people sign in to Casdoor with their authentik accounts over OpenID Connect: the provider settings, and the application and OAuth2 provider to create in authentik.
GitLab Self-Managed
身份提供商Let people sign in to Casdoor with accounts on your own GitLab over OpenID Connect: the provider settings, and the OAuth application to create in GitLab.