Repository navigation
Cambium – bringing Keycloak SSO to Nexus 3 CE without a custom auth realm #52200
fjkhorasani
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Ok so quick one, Nexus 3 CE has no OIDC at all and the plugin that used to fix that (flytreeleft/nexus3-keycloak-plugin) has been dead since 2021. Turns out Nexus already ships something called RutAuthRealm that just trusts a header as an authenticated identity, so you put a real OIDC proxy in front doing the Keycloak handshake and Nexus never even knows OIDC exists.
Built Cambium to handle the one thing thats actually missing, keeping Nexus roles synced with Keycloak groups, plus a shim for CLI logins (docker/npm/pip cant do a browser redirect).
Ran into a couple annoying Keycloak API things along the way, GET /groups doesnt actually give you subgroups no matter what and direct-role users need their own discovery path, wrote it up in the README if that saves anyone time.
v1.0.0, CI green: https://github.com/Rhizomo/cambium
All reactions