vcenter7.0对接keycloak认证

环境vcenter7.0+keycloak 23(docker)+openldap

1.增加client id

2.启用standard flow and direct access grants are enabled

3.配置好相关urls

4 client 协议 openid-connect选择confidential

5.映射器配置

   1. 增加Hardcoded claim ,Claim value为ldap dc 就是@后面的值

    2.增加脚本 token.setSubject(user.getUsername()); 返回用户名给vcenter,设置返回令牌sub

6.vsphere认证选择adfs.注意OpenID 地址如下:

https://xxcom/realms/xxx/.well-known/openid-configuration

配置参考图: keycloak

脚本内容:

# ls
META-INF  my-script-mapper.js
# cat my-script-mapper.js 
// prints can be used to log information for debug purpose.
token.setSubject(user.getUsername());
ls META-INF/
keycloak-scripts.json
 cat META-INF/keycloak-scripts.json 
{
    "authenticators": [
        {
            "name": "My Authenticator",
            "fileName": "my-script-authenticator.js",
            "description": "My Authenticator from a JS file"
        }
    ],
    "policies": [
        {
            "name": "My Policy",
            "fileName": "my-script-policy.js",
            "description": "My Policy from a JS file"
        }
    ],
    "mappers": [
        {
            "name": "My Mapper",
            "fileName": "my-script-mapper.js",
            "description": "My Mapper from a JS file"
        }
    ],
    "saml-mappers": [
        {
            "name": "My Mapper",
            "fileName": "my-script-mapper.js",
            "description": "My Mapper from a JS file"
        }
    ]
}

通过命令 jar -cvf打包成jar上传到keycloak 容器指定目录providers 然后执行bin/kc.[sh|bat] build 重启,记住需要启用 

 -Dkeycloak.profile.feature.scripts=enabled -Dkeycloak.profile.feature.upload_scripts=enabled