Configuring Keycloak IdP for Private Share Link

You can configure authentication through Keycloak to allow standard, policy, and procedure links to be shared with others within your organization. This article will help you to configure single sign-on (SSO) authentication to redirect URLs between your IdP and OneTrust.

You will need to reference information found within the Keycloak tool to complete the SSO configuration within the OneTrust application.

Step 1: Create a Client ID in the Keycloak Tool

Note:

For complete Keycloak documentation and troubleshooting, see the Keycloak Server Administration Guide.

To configure OneTrust with Keycloak for sharing links to standards, policies, or procedures you must create a client ID. Once you've created the client ID in Keycloak, you will then configure the Enable Single Sign-On for Share Link setting within the OneTrust application.

  1. Log into the Keycloak Admin Panel and select the Clients menu.

  2. On the Clients screen, click Create. The Add Client screen appears.



    Field
    Description
    Import

    Click the Select File button if you have an XML file from a service provider. You can select an import file and upload metadata.

    Client ID

    Enter a client ID name that will be used to configure SSO share link within OneTrust. The client ID should be easily identifiable by the customer.

    Client Protocol

    Select the open-connect option.

    Root URL

    This field is not required for this procedure.

  3. Complete the Client ID and Client Protocol fields.

  4. Click the Save button. The client will be created and you will be directed to the Settings tab.



  5. On the Settings tab, select confidential in the Access Type field.

  6. Enter the redirect URL into the Valid Redirect URls field. The redirect URL can be copied from the share link configuration in the OneTrust application.

  7. Click the Save button. The Credentials tab will appear.

  8. On the Credentials tab, select Client Id and Secret in the Client Authenticator field.



  9. Copy the text in the Secret field. This will be used as the Client Key when configuring the share link in OneTrust.

Step 2: Enable Single Sign-On for Private Share Link in the OneTrust Application

You can configure authentication through an identity provider to allow links to be shared within your organization. When a user accesses a private link, their login will be remembered while the login session is active. The session length will depend on the IdP.

Note:

Active SSO logins for another tool will carry over to private share link since authentication will be done using the IdP only.

  1. On the Policy menu, select Settings. The Policy Management Settings screen appears.

  2. Turn on the Enable Single Sign-On for Share Link setting.

  3. Click the Identity Provider Configuration field and select Add New. The Identity Provider Setup modal appears.

  4. Enter the required fields.



    Field
    Description
    Identity Provider Name

    Enter a name for the identity provider.

    Base URL

    Enter a valid IdP host name for the identity provider in the form of http://localhost:8080/auth/realms/primary/.well-known/openid-configuration.

    For example, https://{base-context}/auth/realms/{placeholder}/.well-known/openid-configuration.

    This is not the redirect URL, it is the IdP base URL. The Validate button will not validate against the registered IdP.

    Note:

    The IdP can be reused if one is already created. If you enter a duplicate Identify Provider Name and Base URL, it will be restricted.

  5. Click the Validate button. The ID Provider Console Setup and the Required Authentication Credentials will appear.



  6. In the Client ID field, enter the Client ID name used in Step 2 of the Step 1: Create a Client ID in the Keycloak Tool section above.

  7. Paste the content in the Secret field from Keycloak into the Client Key field in the OneTrust application





  8. Click the Save button in the OneTrust application.

  9. Click the Copy button next to the Published Document URL.



  10. Enter the redirect URL into the Valid Redirect URls field in Keycloak and click the Save button. This field can be found on the Settings tab.