# Help with adminAuth config for OpenID based authentication

**URL:** https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058
**Category:** General
**Created:** [22 December 2018 05:48 UTC](https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058 "2018-12-22T05:48:01Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![riplatt](https://avatars.discourse-cdn.com/v4/letter/r/77aa72/32.png) [@riplatt](https://discourse.nodered.org/u/riplatt)
#### Post date: [22 December 2018 05:48 UTC](https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058/1 "2018-12-22T05:48:01Z")

</div>

Hi,  
Editing this topic as I need help in working this out, [this post](https://discourse.nodered.org/t/adminauth-config-for-keycloak-openid-based-authentication/6058/2?u=riplatt) describes the problem I'm having, is there more documentation on adminAuth anywhere or am I just missing something?

Any help here is much appreciated

Thanks

-------------------------------------------------Old Posts-------------------------------------------------  
Hi,  
I'm looking at using keycloak for authenticating my logon to my node-red.

Question: has anybody done this and is willing to share?

So what I plan on doing is using ether [keycloak-passport](https://github.com/exlinc/keycloak-passport) or [passport-openidconnect](https://github.com/jaredhanson/passport-openidconnect)

Current play config for :

```auto
adminAuth: {
    type:"strategy",
    strategy: {
        name: "keycloak",
        label: 'Sign in with KeyCloak',
        icon:"fa-key",
        strategy: require("keycloak-passport").Strategy,
        options: {
            host: "https://auth.example.com",
            realm: "MyRealm",
            clientID: "node-red",
            clientSecret: "433abd41-c893-48ea-aabb-ca22c8fc290c",
            callbackURL: "http://example.com/auth/strategy/callback"
            verify: function(accessToken, refreshToken, profile, done) {
                done(null, profile);
            }
        },
    },
    users: [
       { username: "*",permissions: ["*"]}
    ]
};

```

Disclaimer; as of writing I have not tested any of this just putting the question out there to maybe save me some pain

Thanks for any help

---

<div class="post-metadata">

### Author: ![riplatt](https://avatars.discourse-cdn.com/v4/letter/r/77aa72/32.png) [@riplatt](https://discourse.nodered.org/u/riplatt)
#### Post date: [22 December 2018 06:25 UTC](https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058/2 "2018-12-22T06:25:50Z")

</div>

So trying to run a little test, I do run into problems

current config:

```auto
adminAuth: {
    type:"strategy",
    strategy: {
        name: "keycloak",
        label: 'Sign in with KeyCloak',
        icon:"fa-key",
        strategy: require("@exlinc/keycloak-passport"),
        options: {
            host: "https://auth.example.com",
            realm: "MyRealm",
            clientID: "node-red",
            clientSecret: "433abd41-c893-48ea-aabb-ca22c8fc290c",
            callbackURL: "https://example.com/auth/strategy/callback",
            authorizationURL: "https://auth.example.com/auth/realms/MyRealm/protocol/openid-connect/auth",
            tokenURL: "https://auth.example.com/auth/realms/MyRealm/protocol/openid-connect/token",
            userInfoURL: "https://auth.example.com/auth/realms/MyRealm/protocol/openid-connect/userinfo"
        },
        verify: function(accessToken, refreshToken, profile, done) {
            done(null, profile);
        }
    },
    users: [
       { username: "me@example.com", permissions: ["*"]}
    ]
},

```

I get a error on the call back `https://example.com/auth/strategy/callback`:

```nohighlight
Error: Unknown authentication strategy "keycloak"
    at attempt (/usr/lib/node_modules/node-red/node_modules/passport/lib/middleware/authenticate.js:186:37)
    at authenticate (/usr/lib/node_modules/node-red/node_modules/passport/lib/middleware/authenticate.js:362:7)
    at Layer.handle [as handle_request] (/usr/lib/node_modules/node-red/node_modules/express/lib/router/layer.js:95:5)
    at next (/usr/lib/node_modules/node-red/node_modules/express/lib/router/route.js:137:13)
    at Route.dispatch (/usr/lib/node_modules/node-red/node_modules/express/lib/router/route.js:112:3)
    at Layer.handle [as handle_request] (/usr/lib/node_modules/node-red/node_modules/express/lib/router/layer.js:95:5)
    at /usr/lib/node_modules/node-red/node_modules/express/lib/router/index.js:281:22
    at Function.process_params (/usr/lib/node_modules/node-red/node_modules/express/lib/router/index.js:335:12)
    at next (/usr/lib/node_modules/node-red/node_modules/express/lib/router/index.js:275:10)
    at SessionStrategy.strategy.pass (/usr/lib/node_modules/node-red/node_modules/passport/lib/middleware/authenticate.js:338:9)

```

---

<div class="post-metadata">

### Author: ![riplatt](https://avatars.discourse-cdn.com/v4/letter/r/77aa72/32.png) [@riplatt](https://discourse.nodered.org/u/riplatt)
#### Post date: [26 December 2018 19:34 UTC](https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058/3 "2018-12-26T19:34:00Z")

</div>

Sorry for the bump, just trying to get some help.

---

<div class="post-metadata">

### Author: ![stgv](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@stgv](https://discourse.nodered.org/u/stgv)
#### Post date: [8 April 2019 07:58 UTC](https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058/4 "2019-04-08T07:58:56Z")

</div>

I ran into basically the same issue when trying to set up the GitLab passport. The "unknown authentication strategy" is basically caused when the **name** property you provide does not match the name expected by the _passport.authenticate()_ function as first argument. Note that proper capitalization matters. I don't know what your KeyCloak passport module requires, but e.g. for passport-gitlab (and passport-gitlab2!) **name** must be _"gitlab"_, not _"GitLab"_ or whatever else.

---

<div class="post-metadata">

### Author: ![bruegth](https://avatars.discourse-cdn.com/v4/letter/b/d6d6ee/32.png) [@bruegth](https://discourse.nodered.org/u/bruegth)
#### Post date: [2 July 2019 13:51 UTC](https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058/5 "2019-07-02T13:51:18Z")

</div>

The name must be "Keycloak"

---

<div class="post-metadata">

### Author: ![riplatt](https://avatars.discourse-cdn.com/v4/letter/r/77aa72/32.png) [@riplatt](https://discourse.nodered.org/u/riplatt)
#### Post date: [17 June 2020 22:29 UTC](https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058/7 "2020-06-17T22:29:13Z")

</div>

I have this working with:

```javascript
adminAuth: {
    type: "strategy",
    strategy: {
        name: "Keycloak",
        label: 'Sign in with KeyCloak',
        icon: "fa-key",
        strategy: require("@exlinc/keycloak-passport"),
        options: {
            host: "https://nodered.example.com",
            realm: "myRealm",
            clientID: "node-red",
            clientSecret: "761a35f4-f2bf-48ee-b2cb-999351d0242f",
            callbackURL: "/auth/strategy/callback",
            authorizationURL: "https://auth.example.com/auth/realms/myRealm/protocol/openid-connect/auth",
            tokenURL: "https://auth.example.com/auth/realms/myRealm/protocol/openid-connect/token",
            userInfoURL: "https://auth.example.com/auth/realms/myRealm/protocol/openid-connect/userinfo"
        },
        verify: function (accessToken, refreshToken, profile, done) {
            done(null, profile);
        }
    },
    users: [
        { username: "me@example.com", permissions: ["*"] }
    ]
},

```

and Keycloak settings of:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/6/b/6ba535751892f6eb62844f4aa2200a15cb181fcb.png)

Note the http and not https in the redirect URL, as node-red was sending a redirect\_uri of

```nohighlight
https://auth.example.com/auth/realms/YendorINC/protocol/openid-connect/auth?
response_type=code&
redirect_uri=http%3A%2F%2Fnodered.example.com%2Fauth%2Fstrategy%2Fcallback&
client_id=node-red

```

this could be from running behind a proxy (Traefik) doing the tls for my sites.

@sarosh maybe try setting you `callbackURL` to just `/auth/strategy/callback` and your host to the host url of the nodered server [but I don't know how keycloak can call back to a localhost???]

Regards,

---

<div class="post-metadata">

### Author: ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [17 June 2020 22:36 UTC](https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058/8 "2020-06-17T22:36:00Z")

</div>

@sarosh my guess is the user you have in the users array has a username of `admin` - but it should be the username you are authenticating with keycloak, which I assume would more likely be an email address.

---

<div class="post-metadata">

### Author: ![sarosh](https://avatars.discourse-cdn.com/v4/letter/s/f08c70/32.png) [@sarosh](https://discourse.nodered.org/u/sarosh)
#### Post date: [18 June 2020 15:12 UTC](https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058/9 "2020-06-18T15:12:30Z")

</div>

@knolleary Thanks your solution worked, I actually created a user with some other username.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)
#### Post date: [2 July 2020 15:12 UTC](https://discourse.nodered.org/t/help-with-adminauth-config-for-openid-based-authentication/6058/10 "2020-07-02T15:12:32Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.