Skip to main content

A simple Django app to use keycloak over OIDC

Project description

Keycloak OIDC

Keycloak OIDC is a simple Django app that wraps the mozilla_django_oidc app and implements Keycloak authentication the way we use it at Datapunt.

It creates and updates users and sets their email, username and first- and lastname based on the info provided by keycloak, and manages group membership based on keycloak roles.

Quick start

  1. Install using pip

    pip install datapunt_keycloak_oidc
  2. Add "keycloak-oidc" to your INSTALLED_APPS (make sure to load after auth!):

        'keycloak_oidc',  # load after auth!
  3. Add the mozilla_django_oidc.SessionRefreshMiddleware to your MIDDLEWARE (middleware involving session and authentication must come first!):

  4. Add the OIDCAuthenticationBackend to the AUTHENTICATION_BACKENDS:

  5. In import the default OIDC settings. These defaults will work in most situations.

    # Import from keycloak_oidc settings and use the defaults
    from keycloak_oidc.default_settings import *
  6. Set the OIDC_RP_CLIENT_ID and OIDC_RP_CLIENT_SECRET in Note that these should be kept secret. Therefore these should preferable be set in the OS ENV. Obtain these from the keycloak provider.


    Keycloak only talks to urls that are whitelisted. Therefore, make sure that the app url for production is added to keycloak. To make local development possible, also make sure localhost:8080 (or any other port) is added.

  7. Add the OIDC provider URLs to, and set the proper OS env. This default will fall back to the acceptance keycloak urls.

  8. When using Django-rest-framework, add the mozilla_django_oidc OIDCAuthentication to the default authentication classes (and make sure the DRF SessionAuthentication has been added):

    REST_FRAMEWORK = dict(
  9. When using Django-rest-framework, override the InAuthGroup permission class to implement role based access control:

    from keycloak_oidc.drf.permissions import InAuthGroup
    class InTestAuthGroup(InAuthGroup):
        A permission to allow access if and only if a user is logged in,
        and is a member of the 'test' role inside keycloak.
        allowed_group_names = ['test']
  10. Include the keycloak-oidc URLconf in your project

    url(r'^oidc/', include('keycloak_oidc.urls')),
  11. IMPORTANT: Make sure to read through the Mozilla Django OIDC docs:

All settings that can be configured are documented there.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

datapunt-keycloak-oidc-0.5.1.tar.gz (13.0 kB view hashes)

Uploaded Source

Built Distribution

datapunt_keycloak_oidc-0.5.1-py3-none-any.whl (15.4 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page