Authenticating ServicePulse with Keycloak
A four-part walkthrough of putting Keycloak in front of ServicePulse with OpenID Connect, end to end, in Docker.
-
Authenticating ServicePulse with Keycloak, Part 1: setting the stage
ServiceControl 6.13 lets ServicePulse sit behind any OpenID Connect identity provider. This series wires it to Keycloak in Docker, end to end, on a home server.
-
Authenticating ServicePulse with Keycloak, Part 2: the Keycloak side
A realm, a client scope, the audience mapper that catches every first-time setup, and the public client ServicePulse uses to redirect through Keycloak.
-
Authenticating ServicePulse with Keycloak, Part 3: plugging ServiceControl in
The four values that change when you swap identity providers, the audit instance that mirrors them, the forwarded headers ServiceControl trusts behind a reverse proxy, and the moment the browser finally lands back in ServicePulse with a token.
-
Authenticating ServicePulse with Keycloak, Part 4: when OIDC goes wrong, and what the POC leaves out
The error messages every first-time setup hits, what each one actually means, the fix, and the list of things that need to change before this configuration leaves the lab.
