You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
How to implement workload federation for CircleCI / GitHub Actions via OIDC ID tokens
#24286
we use Keycloak as IDP for our APIs and I want to get rid of the static username & password login flows used for testing in CI pipelines. My idea is to use the tokens provided by CircleCI or GitHub in order to exchange those for a JWT from our Keycloak with suitable roles set to run a test.
What is the way to implement token exchange via OIDC ID token and checking / mapping the claims set in the ID token against rules or users set in Keycloak?
How to add the CircleCI IDP with the given limited (JWKS only) features to Keycloak?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hello,
we use Keycloak as IDP for our APIs and I want to get rid of the static username & password login flows used for testing in CI pipelines. My idea is to use the tokens provided by CircleCI or GitHub in order to exchange those for a JWT from our Keycloak with suitable roles set to run a test.
It seems to me like Keycloak Token Exchange - external to internal should be able to solve this, but I can't add the CircleCI IDP to Keycloak.
My problem is in the "Add OpenID Connect v1.0 provider" screen:
CircleCI provides only an issuer and
jwks_uribut not an authorization or token URL and it also doesn't require client ID or secret.The
.well-known/openid-configurationof the CircleCI IDP looks like this:{ "claims_supported": [ "aud", "sub", "iss", "iat", "exp", "oidc.circleci.com/project-id", "oidc.circleci.com/context-ids", "oidc.circleci.com/vcs-ref", "oidc.circleci.com/vcs-origin" ], "id_token_signing_alg_values_supported": [ "RS256" ], "issuer": "https://oidc.circleci.com/org/OUR-ACCOUNT-UUID", "jwks_uri": "https://oidc.circleci.com/org/OUR-ACCOUNT-UUID/.well-known/jwks-pub.json", "request_uri_parameter_supported": false, "response_types_supported": [ "id_token" ], "scopes_supported": [ "openid" ], "service_documentation": "https://circleci.com/docs/2.0/openid-connect-tokens/", "subject_types_supported": [ "public", "pairwise" ] }So my questions are:
All reactions