> ## Documentation Index
> Fetch the complete documentation index at: https://wundergraphinc-brendan-add-external-directive.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Keycloak

> Setting up SSO with Keycloak

### Steps to set Keyclaok as an OIDC identity provider

<Steps>
  <Step>
    Navigate to the **Clients** view within your Keyclaok Dashboard.
  </Step>

  <Step>
    Click on **Create Client**.
  </Step>

  <Step>
    Select OpenID Connect as the **Client Type, and** give the client a  **Client ID**and a  **Name**and then click on **Next.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-23.png" />
    </Frame>
  </Step>

  <Step>
    Enable **Client authentication,** then click on **Next** and then click on  **Save**on the next page**.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-24.png" />
    </Frame>
  </Step>

  <Step>
    Navigate to the **Credentials** tab and then copy the **Client Secret.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-25.png" />
    </Frame>
  </Step>

  <Step>
    Navigate to the **Realm Settings** and then copy the link of **OpenID Endpoint Configuration.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-26.png" />
    </Frame>
  </Step>

  <Step>
    Navigate to the settings page on Cosmo.
  </Step>

  <Step>
    Click on **Connect.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/connect_oidc.png" />
    </Frame>
  </Step>

  <Step>
    Give the connection a name, paste the **OpenID Endpoint Configuration** copied before, into the  **Discovery Endpoint,**and paste the **Client ID** and  **Client secret**copied before into the **Client ID** and  **Client Secret fields respectively,**and then click on **Connect.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/connect-oidc-dialog.png" />
    </Frame>
  </Step>

  <Step>
    Configure the mapping between the roles in Cosmo and the user groups in Keycloak. The field **Group in the provider** can be populated with the name of the group or a regex to match the user groups. Once all the mappers are configured, click on **Save**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/map-oidc-groups.png" />
    </Frame>
  </Step>

  <Step>
    Copy the sign-in and sign-out redirect URIs displayed in the dialog.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/connect-oidc-success.png" />
    </Frame>
  </Step>

  <Step>
    Navigate back to the client created on Keycloak and populate the **Valid redirect URIs** and **Valid post Logout redirect URIs** with the above-copied sign-in and sign-out URLs respectively. Click on **Save**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-31.png" />
    </Frame>
  </Step>

  <Step>
    Navigate to the **Client Scopes** tab, click on the first client scope(usually would be \$\{**clientID}-dedicated**), and then click on **Configure a new mapper.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-32.png" />
    </Frame>
  </Step>

  <Step>
    Select **Group Membership.**

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/wundergraphinc-brendan-add-external-directive/images/studio/sso/image-33.png" />
    </Frame>
  </Step>

  <Step>
    Give the mapper a name, then populate the **Token Claim Name** with **"**ssoGroups**"** and then click on **Save.**
  </Step>

  <Step>
    Now you can assign users/groups to the application, and those users will be able to log into Cosmo using the URL provided on setting up the provider.
  </Step>
</Steps>