OpenID Connect (OIDC)
Discovery-based SSO for your customers
Your customer provides their discovery URL and client credentials; RealmSSO provisions the Keycloak Identity Provider configuration — with client secrets encrypted at rest. See /docs/api/connections for the connection contract.
Why OpenID Connect (OIDC)?
Everything you need for enterprise-grade identity federation.
Discovery-Based Setup
Enter your provider’s discovery URL and the endpoints and configuration are fetched automatically, ready for Keycloak to provision.
Automatic Provisioning
When the discovery document is reachable, RealmSSO provisions a Keycloak identity provider automatically — with the redirect URI your customer whitelists in their IdP.
Secret Encryption
OIDC client secrets are encrypted at rest using AES-256-GCM before being stored in the database — the round-trip is covered by the project’s test suite.
Redirect URI handled by Keycloak
The redirect (broker) URI your customer enters in their OIDC provider is surfaced per connection; the authorization code exchange happens inside Keycloak, never proxied through RealmSSO.
Connection Testing
Run an on-demand test on the connection to verify it is provisioned and reachable. There is no scheduled automatic health-check job yet.
Ready to get started?
Deploy RealmSSO on your infrastructure and give your customers the enterprise SSO experience they expect.