KeyCloak SSO with multiple legacy applications

Getting advice
,
1

Hello, folks:

We currently have several web and desktop applications that authenticate users using a username/password form POST with credentials from MS Active Directory, some systems store user authentication in their own databases.

Recently, stakeholders have requested that our systems implement SSO and MFA. During our technical evaluation, we found that KeyCloak appears to be an excellent tool for managing SSO/MFA across multiple heterogeneous systems.
At present, we’ve successfully connected KeyCloak (ver.20) with MS Active Directory (User federation). We’ve also discovered methods to log in/create client sessions (obtaining id_token/access_token) and log out/clean client session using API.

However, we are unsure how to achieve the following:
“After logging into system 1, how can a user automatically log in to system 2 in the same browser without re-entering the username/password?”
Without modifying system 2, is it possible to query KeyCloak using a token to obtain the user credentials (username/password) for system 2? (System 2 currently only accepts username/password login.)

Any advice would be greatly appreciated.

2

The quick answer is:

  1. Your apps are integrated with OIDC with Keycloak (No ROPC grant)
  2. SSO means having an active IdP session cookie
  • The system 1 (client 1) performs a standard OIDC federation, the user completes the authn mechanism and then, the system 1 gets the tokens, and you have an IdP session :cookie:
  • The system 2 (client 2) performs a standard OIDC federation but you achieve SSO because you have an active IdP session :cookie:, and the system 2 obtains NEW tokens
3

Hello embesozzi,
Thank you for your answer. I’m trying to understand the hints in your response.
I think my direction should involve integrating ‘system2’ with the Keycloak JavaScript adapter .
However, I’m uncertain about the steps needed to ensure that when a user clicks the ‘Login’ button, the ‘IdP session cookie’ is transformed into user credentials (username/password) for logging into the old system.(Or perhaps I misunderstood.)

I’ll do more research.

4

Hi @tzengshinfu,
Yes, each system (app) will use an OIDC library for federation. I recommend checking OpenID Foundation certified libraries.

Lastly, when a user clicks in the login button, as I mentioned before, the app with an OIDC lbrary initiates redirection to the IdP to proceed with the authn step. Your KC authentication flow definition has the first step with the authn type “Cookie”. Therefore, due to the presence of an active and valid :cookie: in the second login, KC will finish the authn as success without further steps. Consequently, the app will get the tokens (meaning the authz code, and the app negotiate the tokens). From the user perspective, this results in Single Sign-On (SSO).

1 Like
5

Hello embesozzi,
Thank you for further explanation and suggestions on the libraries.
:blush::pray::+1::star2::tada: