第 12 課：身份代理和社交登錄

HTMLTAG_806__HTMLTAG_807___4.2 Keycloak SAML SP 元資料___HTMLTAG_808__HTMLTAG_809

外部 SAML IdP 需要 Keycloak 元資料（充當服務提供者）：

預編碼_4

HTMLTAG_812__HTMLTAG_813___5。 OAuth v2 身分提供者___HTMLTAG_814__HTMLTAG_815

對於僅支援 OAuth 2.0（無 OIDC）的提供者：

1. 前往 身分提供者 → 新增提供者 → OAuth v2.0___HTMLTAG_821__HTMLTAG_822___
2. 配置：
   ___HTMLTAG_825__HTMLTAG_826___授權 URL：OAuth2 授權端點 ___HTMLTAG_829__HTMLTAG_830___令牌 URL：OAuth2 令牌端點 ___HTMLTAG_833__HTMLTAG_834___使用者資訊 URL：端點傳回使用者資訊（如果有） ___HTMLTAG_837__HTMLTAG_838___客戶端 ID/客戶端密碼___HTMLTAG_839__HTMLTAG_840___
   • User Info JSON Path: JSONPath to extract user attributes ___預編碼_5___

HTMLTAG_848__HTMLTAG_849___6。 Kubernetes 身分提供者___HTMLTAG_850__HTMLTAG_851

Keycloak 可以充當 Kubernetes 的 IdP，反之亦然可以從 Kubernetes 接收身分。

預編碼_6

預編碼_7

HTMLTAG_858__HTMLTAG_859___7。首次登入流程___HTMLTAG_860__HTMLTAG_861

首次登入流程處理 第一個 使用者透過外部 IdP 登入。此流程決定：

• 我可以在 Keycloak 中建立新使用者嗎？
• 有目前使用者的連結嗎？
• 是否有檢視/更新個人資料的請求？

HTMLTAG_874__HTMLTAG_875___7.1 預設第一個經紀商登入流程___HTMLTAG_876__HTMLTAG_877

預編碼_8

HTMLTAG_878__HTMLTAG_879___7.2 詳細工作原理___HTMLTAG_880__HTMLTAG_881

HTMLTAG_882__HTMLTAG_883___場景 1：全新用戶___HTMLTAG_884__HTMLTAG_885

1. 用戶首次透過 Google 登入__HTMLTAG_888___ ___HTMLTAG_889__HTMLTAG_890___檢視個人資料：顯示來自 Google 的個人資料（電子郵件地址、姓名）以供使用者確認
___HTMLTAG_893__HTMLTAG_894___如果唯一則建立使用者：電子郵件不存在→建立新的Keycloak使用者
2. 將 Google 身分與 Keycloak 使用者關聯
3. 登入成功__HTMLTAG_900___

HTMLTAG_902__HTMLTAG_903___情境 2：Keycloak 中已存在電子郵件___HTMLTAG_904__HTMLTAG_905

1. 使用者透過 GitHub 登錄，電子郵件 [email protected]___HTMLTAG_909__HTMLTAG_910___
2. Create User If Unique: Email already exists → fail → switch to alternative
___HTMLTAG_915__HTMLTAG_916___確認連結現有帳戶：詢問「帳戶 [email protected] 已存在。您想要連結嗎？」 ___HTMLTAG_919__HTMLTAG_920___驗證所有權：使用者透過電子郵件驗證或輸入Keycloak密碼
3. 將 GitHub 身分與現有 Keycloak 使用者關聯

⚠️ 安全警告__HTMLTAG_937___：自動設定現有使用者僅應在您 僅應在您 時使用外部。如果 IdP 允許自由設定電子郵件，攻擊者就可以透過註冊其他人的電子郵件來接管帳戶。

# Trigger account linking từ application
GET /realms/myrealm/protocol/openid-connect/auth?
  client_id=my-app&
  redirect_uri=https://myapp.example.com/callback&
  response_type=code&
  scope=openid&
  kc_action=oidc-link&
  kc_action_parameter=google

# Xem federated identities của user
curl -s -X GET \
  "https://keycloak.example.com/admin/realms/myrealm/users/$USER_ID/federated-identity" \
  -H "Authorization: Bearer $ADMIN_TOKEN" | jq

# Response
[
  {
    "identityProvider": "google",
    "userId": "google-user-id-123",
    "userName": "[email protected]"
  }
]

# Thêm federated identity cho user
curl -X POST \
  "https://keycloak.example.com/admin/realms/myrealm/users/$USER_ID/federated-identity/github" \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "identityProvider": "github",
    "userId": "github-user-id-456",
    "userName": "johndoe"
  }'

# Xóa federated identity
curl -X DELETE \
  "https://keycloak.example.com/admin/realms/myrealm/users/$USER_ID/federated-identity/github" \
  -H "Authorization: Bearer $ADMIN_TOKEN"

# Ví dụ: Google IdP với sync mode = import
# Mapper "Import Avatar" với Sync Mode Override = force

# Kết quả:
# - Email, name: import 1 lần, user có thể sửa trong Keycloak
# - Avatar URL: luôn cập nhật từ Google (force)

# Redirect trực tiếp đến Google login
GET /realms/myrealm/protocol/openid-connect/auth?
  client_id=my-app&
  redirect_uri=https://myapp.example.com/callback&
  response_type=code&
  scope=openid&
  kc_idp_hint=google

# Redirect trực tiếp đến SAML IdP
GET /realms/myrealm/protocol/openid-connect/auth?
  client_id=my-app&
  redirect_uri=https://myapp.example.com/callback&
  response_type=code&
  scope=openid&
  kc_idp_hint=corporate-saml

// keycloak-js adapter
const keycloak = new Keycloak({
  url: 'https://keycloak.example.com',
  realm: 'myrealm',
  clientId: 'my-app'
});

// Đăng nhập qua Google
function loginWithGoogle() {
  keycloak.login({
    idpHint: 'google'
  });
}

// Đăng nhập qua corporate SAML
function loginWithCorporate() {
  keycloak.login({
    idpHint: 'corporate-saml'
  });
}

# Ví dụ: 2 Google IdPs cho 2 Google Workspace domains
Identity Providers:
  - Alias: google-corp        → Google Workspace domain corp.example.com
  - Alias: google-partner     → Google Workspace domain partner.example.com

# Mỗi instance có Client ID / Client Secret riêng
# registered tại Google Cloud Console khác nhau