# OAuth/OpenID login with Keycloak
**URL:** https://discourse.nodered.org/t/oauth-openid-login-with-keycloak/54144
**Category:** General
**Tags:** security
**Created:** [23 November 2021 04:08 UTC](https://discourse.nodered.org/t/oauth-openid-login-with-keycloak/54144 "2021-11-23T04:08:07Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@quarfie](https://discourse.nodered.org/u/quarfie)
#### Post date: [23 November 2021 04:08 UTC](https://discourse.nodered.org/t/oauth-openid-login-with-keycloak/54144/1 "2021-11-23T04:08:08Z")
I would like to authenticate to the Node-RED editor against my Keycloak server.
I used npm to install `passport` and `passport-keycloak-oauth2-oidc`
When I click the button to login, it goes to Keycloak and I login, then it redirects back to Node-RED where I see this error:
```auto
InternalOAuthError: Failed to obtain access token
at Strategy.OAuth2Strategy._createOAuthError (/home/ubuntu/.node-red/node_modules/passport-oauth2/lib/strategy.js:423:17)
at /home/ubuntu/.node-red/node_modules/passport-oauth2/lib/strategy.js:177:45
at /home/ubuntu/.node-red/node_modules/oauth/lib/oauth2.js:191:18
at ClientRequest. (/home/ubuntu/.node-red/node_modules/oauth/lib/oauth2.js:162:5)
at ClientRequest.emit (events.js:314:20)
at Socket.socketErrorListener (_http_client.js:427:9)
at Socket.emit (events.js:314:20)
at emitErrorNT (internal/streams/destroy.js:92:8)
at emitErrorAndCloseNT (internal/streams/destroy.js:60:3)
at processTicksAndRejections (internal/process/task_queues.js:84:21)
```
The URL is `https://node-red.mydomain.com/auth/strategy/callback?session_state=removed&code=removed`
(replaced the codes with "removed")
I wonder if the problem has to do with the `verify` function in the `strategy` object in `settings.js`. I'm not really clear on what's going on here. I left it the same as in the Node-RED example, which is different from the example for `passport-keycloak-oauth2-oidc`...
```auto
adminAuth: {
type:"strategy",
strategy: {
name: "keycloak",
label: 'Sign in',
icon:"fa-lock",
strategy: require("passport-keycloak-oauth2-oidc").Strategy,
options: {
clientID: "node-red",
realm: 'myrealm',
publicClient: "false",
clientSecret: "[deleted]",
sslRequired: "external",
authServerURL: "http://keycloak.mydomain.com/auth",
callbackURL: "https://node-red.mydomain.com/auth/strategy/callback",
verify: function(token, tokenSecret, profile, done) {
done(null, profile);
}
},
},
users: [
{ username: "jason@mydomain.com",permissions: ["*"]}
]
}
```
For bonus points... I'd rather not have to supply the usernames in settings.js. I would rather provide a group name, and it would let in any user that belongs to that group... possible?
---
### Author:  [@quarfie](https://discourse.nodered.org/u/quarfie)
#### Post date: [23 November 2021 23:42 UTC](https://discourse.nodered.org/t/oauth-openid-login-with-keycloak/54144/2 "2021-11-23T23:42:56Z")
@strmar or @heincar did you solve your issue from [adminAuth config for OpenID based Authentication on Keycloak](https://discourse.nodered.org/t/adminauth-config-for-openid-based-authentication-on-keycloak/39442) ?
I am using a different Passport strategy but same problem...
---
### Author:  [@quarfie](https://discourse.nodered.org/u/quarfie)
#### Post date: [24 November 2021 17:03 UTC](https://discourse.nodered.org/t/oauth-openid-login-with-keycloak/54144/3 "2021-11-24T17:03:53Z")
SOLVED!
As you can see if you have eagle eyes, I had input the authServerURL with http instead of https!
---
### Author:  [@quarfie](https://discourse.nodered.org/u/quarfie)
#### Post date: [24 November 2021 17:36 UTC](https://discourse.nodered.org/t/oauth-openid-login-with-keycloak/54144/4 "2021-11-24T17:36:45Z")
Also figured out how to do group-based authentication in case anyone is interested...
Modified the verify function to check for the presence of the required group name and if yes, overwrite the username in the profile object.
```auto
verify: function(token, tokenSecret, profile, done) {
//console.log(profile)
if(profile._json.groups.includes("the-group-name")) {
profile.username='the-group-name'
}
done(null, profile);
}
```
Then the users array just uses the group name instead of the username:
```auto
users: [
{ username: "the-group-name",permissions: ["*"]}
]
```
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [8 December 2021 17:37 UTC](https://discourse.nodered.org/t/oauth-openid-login-with-keycloak/54144/5 "2021-12-08T17:37:17Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.