Keycloak and OIDC sign-in, configured for you
Keycloak comes with the install. Catalog apps arrive with single sign-on already configured, and your own app can get an OIDC client with its settings injected.
Which apps get sign-in configured?
From the catalog: Gitea, Grafana and Rocket.Chat. The OIDC client and callback addresses are created when the app is installed. Rocket.Chat still needs one step by an administrator.
The platform signs in the same way: Argo CD and the Kubernetes API accept the same Keycloak accounts.
What about my own app?
Ask your AI agent. Over MCP it creates an OIDC client for the app, derives the redirect address from where the app is published, and injects OIDC_ISSUER, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET. The app needs a published address first.
Can I use a Keycloak I already run?
Yes. The installer can bring its own Keycloak or use an existing one.
What is not supported yet?
Apps that do not support OIDC, or support it only in a paid enterprise edition, are not connected. Also, a button for your own app's sign-in in the web screens — use the agent for now. And when a client secret is rotated in Keycloak, the change is not yet pushed to apps automatically.
Related
Start free — a trial, no card required.