OpenID Authentication with Keycloak

Follow these steps:

• Find xwiki.authentication.authclass in xwiki.cfg and comment it out with #-# in the beginning.
• Add below: xwiki.authentication.authclass=org.xwiki.contrib.oidc.auth.OIDCAuthServiceImpl
• Open xwiki.properties and adapt the following to your settings, and add this at the end of the file (Note the __XXX__ parts):
  oidc.endpoint.authorization=https://__KEYCLOAK-ADDRESS__/auth/realms/__REALM__/protocol/openid-connect/auth
  oidc.endpoint.token=https://__KEYCLOAK-ADDRESS__/auth/realms/__REALM__/protocol/openid-connect/token
  oidc.endpoint.userinfo=https://__KEYCLOAK-ADDRESS__/auth/realms/__REALM__/protocol/openid-connect/userinfo
  oidc.scope=openid,profile,email,address
  oidc.endpoint.userinfo.method=GET
  oidc.user.nameFormater=${oidc.user.preferredUsername._clean._lowerCase}
  oidc.user.subjectFormater=${oidc.user.subject}
  # oidc.groups.claim=xwiki_groups
  # oidc.groups.mapping=MyXWikiGroup=my-oidc-group
  # oidc.groups.mapping=MyXWikiGroup2=my-oidc-group2
  # oidc.groups.mapping=MyXWikiGroup2=my-oidc-group3
  # oidc.groups.allowed=
  # oidc.groups.forbidden=
  oidc.userinfoclaims=xwiki_user_accessibility,xwiki_user_company,xwiki_user_displayHiddenDocuments,xwiki_user_editor,xwiki_user_usertype
  # oidc.userinforefreshrate=600000
  oidc.clientid=__KEYCLOAK-CLIENT-ID__
  oidc.secret=__KEYCLOAK-CLIENT-SECRET__
  oidc.endpoint.token.auth_method=client_secret_basic
  oidc.skipped=false

  See futher configuration possibilites.

• Adapt the following to your settings and import it to Keycloak (Again: Note the __XXX__ parts):
  {
  "clientId": "__CLIENT-ID__",
  "name": "__CLIENT-NAME__",
  "rootUrl": "https://__YOUR-WIKI-URL__",
  "adminUrl": "https://__YOUR-WIKI-URL__",
  "baseUrl": "https://__YOUR-WIKI-URL__",
  "surrogateAuthRequired": false,
  "enabled": true,
  "alwaysDisplayInConsole": false,
  "clientAuthenticatorType": "client-secret",
  "redirectUris": [
  "https://__YOUR-WIKI-URL____YOUR_WEBAPP_NAME_OR_EMPTY__/authenticator/callback"
  ],
  "webOrigins": [
  "https://__YOUR-WIKI-URL__"
  ],
  "notBefore": 0,
  "bearerOnly": false,
  "consentRequired": false,
  "standardFlowEnabled": true,
  "implicitFlowEnabled": true,
  "directAccessGrantsEnabled": true,
  "serviceAccountsEnabled": true,
  "authorizationServicesEnabled": true,
  "publicClient": false,
  "frontchannelLogout": false,
  "protocol": "openid-connect",
  "attributes": {
  "saml.assertion.signature": "false",
  "saml.force.post.binding": "false",
  "saml.multivalued.roles": "false",
  "saml.encrypt": "false",
  "saml.server.signature": "false",
  "saml.server.signature.keyinfo.ext": "false",
  "exclude.session.state.from.auth.response": "false",
  "saml_force_name_id_format": "false",
  "saml.client.signature": "false",
  "tls.client.certificate.bound.access.tokens": "false",
  "saml.authnstatement": "false",
  "display.on.consent.screen": "false",
  "saml.onetimeuse.condition": "false"
  },
  "authenticationFlowBindingOverrides": {},
  "fullScopeAllowed": false,
  "nodeReRegistrationTimeout": -1,
  "protocolMappers": [{
  "name": "Client Host",
  "protocol": "openid-connect",
  "protocolMapper": "oidc-usersessionmodel-note-mapper",
  "consentRequired": false,
  "config": {
  "user.session.note": "clientHost",
  "id.token.claim": "true",
  "access.token.claim": "true",
  "claim.name": "clientHost",
  "jsonType.label": "String"
  }
  },
  {
  "name": "Client IP Address",
  "protocol": "openid-connect",
  "protocolMapper": "oidc-usersessionmodel-note-mapper",
  "consentRequired": false,
  "config": {
  "user.session.note": "clientAddress",
  "id.token.claim": "true",
  "access.token.claim": "true",
  "claim.name": "clientAddress",
  "jsonType.label": "String"
  }
  },
  {
  "name": "address",
  "protocol": "openid-connect",
  "protocolMapper": "oidc-address-mapper",
  "consentRequired": false,
  "config": {
  "user.attribute.formatted": "formatted",
  "user.attribute.country": "country",
  "user.attribute.postal_code": "postal_code",
  "userinfo.token.claim": "true",
  "user.attribute.street": "street",
  "id.token.claim": "true",
  "user.attribute.region": "region",
  "access.token.claim": "true",
  "user.attribute.locality": "locality"
  }
  },
  {
  "name": "Client ID",
  "protocol": "openid-connect",
  "protocolMapper": "oidc-usersessionmodel-note-mapper",
  "consentRequired": false,
  "config": {
  "user.session.note": "clientId",
  "id.token.claim": "true",
  "access.token.claim": "true",
  "claim.name": "clientId",
  "jsonType.label": "String"
  }
  }
  ],
  "defaultClientScopes": [
  "web-origins",
  "role_list",
  "roles",
  "profile",
  "email"
  ],
  "optionalClientScopes": [
  "address",
  "phone",
  "offline_access",
  "microprofile-jwt"
  ],
  "access": {
  "view": true,
  "configure": true,
  "manage": true
  }
  }