# Connecting External Identity Providers

This guide explains how to integrate external identity providers (IdPs) like <span class="s3">**Google, GitHub, Facebook**</span>, or <span class="s3">**LDAP/Active Directory**</span> into a Keycloak realm. It walks through the necessary setup, configuration, and execution of a login flow that delegates authentication to the external provider.

## **Variables**

Certain parameters must be provided to integrate an external identity provider into Keycloak. Below is a breakdown of each required variable, its purpose, and where to find it. Here’s what each variable represents:

<table border="1" id="bkmrk-variable-description" style="width: 100%; border-collapse: collapse; border-color: rgb(0, 0, 0);"><thead><tr><th style="width: 15.4922%; border-color: rgb(0, 0, 0);">**Variable**

</th><th style="width: 42.3147%; border-color: rgb(0, 0, 0);">**Description**

</th><th style="width: 42.1931%; border-color: rgb(0, 0, 0);">**Purpose**

</th></tr></thead><tbody><tr><td style="width: 15.4922%; border-color: rgb(0, 0, 0);">`IDP_ALIAS`

</td><td style="width: 42.3147%; border-color: rgb(0, 0, 0);">Unique alias name for the identity provider in Keycloak

</td><td style="width: 42.1931%; border-color: rgb(0, 0, 0);">Used to identify and manage the identity provider internally

</td></tr><tr><td style="width: 15.4922%; border-color: rgb(0, 0, 0);">`CLIENT_ID`

</td><td style="width: 42.3147%; border-color: rgb(0, 0, 0);">OAuth2/OpenID Connect Client ID provided by the external IdP

</td><td style="width: 42.1931%; border-color: rgb(0, 0, 0);">Authenticates Keycloak with the external provider

</td></tr><tr><td style="width: 15.4922%; border-color: rgb(0, 0, 0);">`CLIENT_SECRET`

</td><td style="width: 42.3147%; border-color: rgb(0, 0, 0);">Client secret provided by the external IdP

</td><td style="width: 42.1931%; border-color: rgb(0, 0, 0);">Used for secure communication with the IdP

</td></tr><tr><td style="width: 15.4922%; border-color: rgb(0, 0, 0);">`AUTH_URL`

</td><td style="width: 42.3147%; border-color: rgb(0, 0, 0);">Authorization endpoint of the external provider

</td><td style="width: 42.1931%; border-color: rgb(0, 0, 0);">Used to start the OAuth2 login flow

</td></tr><tr><td style="width: 15.4922%; border-color: rgb(0, 0, 0);">`TOKEN_URL`

</td><td style="width: 42.3147%; border-color: rgb(0, 0, 0);">Token endpoint of the external provider

</td><td style="width: 42.1931%; border-color: rgb(0, 0, 0);">Used to exchange authorization code for access token

</td></tr><tr><td style="width: 15.4922%; border-color: rgb(0, 0, 0);">`USERINFO_URL`

</td><td style="width: 42.3147%; border-color: rgb(0, 0, 0);">User info endpoint of the external provider (for OIDC)

</td><td style="width: 42.1931%; border-color: rgb(0, 0, 0);">Fetches profile info for the logged-in user

</td></tr></tbody></table>

These values are available from the external identity provider’s developer console (e.g., Google Cloud Console, GitHub Developer Settings, Facebook for Developers, or LDAP configuration).

## **Prerequisites**

#### **Keycloak Admin Access**

Make sure you are logged into the Keycloak Admin Console with sufficient permissions to:

- Modify identity providers
- Configure clients and mappers
- Assign default roles or groups (optional)

#### **External Provider Setup**

You must first register your Keycloak app with the external identity provider (e.g., Google, GitHub, etc.) and obtain the <span class="s2">**client ID**</span> and <span class="s2">**client secret**</span>, along with <span class="s2">**redirect URI**</span>.

Example (Google):

- Go to [https://console.cloud.google.com](https://console.cloud.google.com)
- Register a new OAuth2 Client under <span class="s1">**APIs &amp; Services &gt; Credentials**</span>
- Set redirect URI to:

```
https://<keycloak-domain>/realms/<your-realm>/broker/google/endpoint
```

## **Code-Free Setup (via Keycloak Admin UI)**

1. **Go to your realm &gt; Identity Providers**
2. **Click “Add provider” → Choose from list (e.g., Google, GitHub, Facebook, etc.)**
    
    [![image.png](https://docs.elest.io/uploads/images/gallery/2025-06/scaled-1680-/72Yimage.png)](https://docs.elest.io/uploads/images/gallery/2025-06/72Yimage.png)
3. Enter the required fields:
    
    
    - <span class="s1">**Alias**</span><span class="s2">: </span>google<span class="s2">, </span>github<span class="s2">, etc.</span>
    - <span class="s1">**Client ID**</span>: From the external IdP
    - <span class="s1">**Client Secret**</span>: From the external IdP
4. Configure <span class="s1">**Default Scopes**</span> and any user attribute mappers (e.g., email, name)
5. Enable the provider by checking <span class="s1">**“Enabled”**</span>
6. Save

You’ll now see the provider appear on your login page as a social button or link.

## **LDAP / Active Directory Integration**

For enterprise identity backends like <span class="s2">**LDAP**</span> or <span class="s2">**Active Directory**</span>, follow these steps:

- <span class="s1">Go to </span>**User Federation &gt; Add Provider → LDAP**
- Fill in the following fields:

<table id="bkmrk-field-example-connec" style="width: 55.7143%;"><thead><tr><th style="width: 26.1242%;">**Field**

</th><th style="width: 73.8758%;">**Example**

</th></tr></thead><tbody><tr><td style="width: 26.1242%;">Connection URL

</td><td style="width: 73.8758%;">ldap://ldap.mycompany.com

</td></tr><tr><td style="width: 26.1242%;">Users DN

</td><td style="width: 73.8758%;">ou=users,dc=mycompany,dc=com

</td></tr><tr><td style="width: 26.1242%;">Bind DN

</td><td style="width: 73.8758%;">cn=admin,dc=mycompany,dc=com

</td></tr><tr><td style="width: 26.1242%;">Bind Credential

</td><td style="width: 73.8758%;">Your LDAP admin password

</td></tr><tr><td style="width: 26.1242%;">Vendor

</td><td style="width: 73.8758%;">Choose from Active Directory, Novell, Red Hat, etc.

</td></tr></tbody></table>

- Set <span class="s1">Edit Mode</span> to <span class="s1">READ\_ONLY</span> or <span class="s1">WRITABLE</span> based on your use case
- Enable periodic sync if needed under <span class="s1">**Sync Settings**</span>
- Save and test the connection

## **Execution**

Once saved, test the login by:

1. Navigating to the Keycloak login page
2. <span class="s1">You will now see </span>**“Login with Google”**<span class="s1">, </span>**“Login with GitHub”**<span class="s1">, etc.</span>
3. Click the button to initiate the external login
4. Upon successful authentication, you will be redirected back to Keycloak with a valid session

You can manage the linked identity in the Keycloak Admin Console under:

```
Users > [user] > Identity Provider Links
```