Keycloak Integration

Once you've got Keycloak setup per Keycloak Setup

Now that Keycloak is all setup, it's time to configure variantgrid. you will need the Client Secret (hopefully recorded from when you setup Keycloak, though you can always log back in to Keycloak to see it again)

The OIDC code lives in the oidc_auth app, which needs to be added to INSTALLED_APPS.

Keep the client secret out of source control — put it in /etc/variantgrid/settings_config.json and read it with get_secret() (see Settings).

Here's an example of the values you will need for your settings — this mirrors variantgrid/settings/env/shariantcommon.py, which is the live reference:

INSTALLED_APPS = ["oidc_auth"] + INSTALLED_APPS

AUTHENTICATION_BACKENDS = (
    'oidc_auth.backend.VariantGridOIDCAuthenticationBackend',
    'django.contrib.auth.backends.ModelBackend',  # default
    'guardian.backends.ObjectPermissionBackend',
)

MIDDLEWARE += (
    'oidc_auth.session_refresh.VariantGridSessionRefresh',
    'oidc_auth.oidc_error_handler.HandleOIDC400Middleware',
)

REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    ),
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'mozilla_django_oidc.contrib.drf.OIDCAuthentication',
        'rest_framework.authentication.SessionAuthentication'
    ],
}

# OIDC SETTINGS
USE_OIDC = True
OIDC_STORE_ID_TOKEN = True  # needed so we can pass the token back to keycloak for an automatic logout
LOGIN_URL = '/oidc_login/'
OIDC_USE_PKCE = True
OIDC_PKCE_CODE_CHALLENGE_METHOD = 'S256'
OIDC_RP_SIGN_ALGO = 'RS256'

# Need to set the below
OIDC_RP_CLIENT_ID = 'variant-grid'
OIDC_RP_CLIENT_SECRET = get_secret('OIDC.client_secret')
KEY_CLOAK_BASE = 'https://auth.yourdomain.com'
KEY_CLOAK_REALM = 'healthauth'
# Stop setting

KEY_CLOAK_PROTOCOL_BASE = KEY_CLOAK_BASE + '/realms/' + KEY_CLOAK_REALM + '/protocol/openid-connect'
OIDC_OP_JWKS_ENDPOINT = KEY_CLOAK_PROTOCOL_BASE + '/certs'
OIDC_OP_AUTHORIZATION_ENDPOINT = KEY_CLOAK_PROTOCOL_BASE + '/auth'
OIDC_OP_TOKEN_ENDPOINT = KEY_CLOAK_PROTOCOL_BASE + '/token'
OIDC_OP_USER_ENDPOINT = KEY_CLOAK_PROTOCOL_BASE + '/userinfo'
OIDC_USER_SERVICES = KEY_CLOAK_BASE + '/realms/' + KEY_CLOAK_REALM + '/account'
OIDC_OP_LOGOUT_URL_METHOD = 'oidc_auth.backend.provider_logout'

LOGIN_REDIRECT_URL = '/variantopedia/dashboard'
LOGIN_REDIRECT_URL_FAILURE = '/accounts/logout/'
# Where to send the browser after Keycloak logout completes
LOGOUT_REDIRECT_URL = 'https://yourdomain.com'

Note on KEY_CLOAK_BASE: Keycloak 17+ (Quarkus) dropped the /auth path prefix, so the base is just the host. If you're on a legacy WildFly Keycloak you'll need https://host/auth instead.

Logout is handled by oidc_auth.backend.provider_logout, which builds ${KEY_CLOAK_PROTOCOL_BASE}/logout and — when LOGOUT_REDIRECT_URL is set — passes the stored ID token as id_token_hint plus post_logout_redirect_uri (hence OIDC_STORE_ID_TOKEN = True), so the user is logged out of Keycloak as well as VariantGrid.