Add keycloak OAuth provider by tazouxme · Pull Request #13033 · apache/cloudstack

tazouxme · 2026-04-15T19:11:57Z

Description

Add Keycloak as a new OAuth provider. This PR adds two new fields in the UI and in the DB:

Authorization URL
Token URL

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Screenshots (if appropriate):

How Has This Been Tested?

Manual testing using local Keycloak instance with basic Realm

boring-cyborg · 2026-04-15T19:12:01Z

Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
Here are some useful points:

In case of a new feature add useful documentation (raise doc PR at https://github.com/apache/cloudstack-documentation)
Be patient and persistent. It might take some time to get a review or get the final approval from the committers.
Pay attention to the quality of your code, ensure tests are passing and your PR doesn't have conflicts.
Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Issues, Mailing list and Slack.
Be sure to read the CloudStack Coding Conventions.
Apache CloudStack is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@cloudstack.apache.org (https://cloudstack.apache.org/mailing-lists.html)
Slack: https://apachecloudstack.slack.com/

sureshanaparti · 2026-04-16T04:46:55Z

@blueorangutan package

blueorangutan · 2026-04-16T04:48:03Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

codecov · 2026-04-16T04:55:25Z

Codecov Report

❌ Patch coverage is 59.60265% with 61 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.90%. Comparing base (a73cc9a) to head (832de07).
⚠️ Report is 74 commits behind head on main.

Files with missing lines	Patch %	Lines
...dstack/oauth2/keycloak/KeycloakOAuth2Provider.java	76.54%	13 Missing and 6 partials ⚠️
...ack/oauth2/api/response/OauthProviderResponse.java	25.00%	12 Missing ⚠️
...k/oauth2/api/command/RegisterOAuthProviderCmd.java	15.38%	10 Missing and 1 partial ⚠️
...ack/oauth2/api/command/UpdateOAuthProviderCmd.java	0.00%	8 Missing ⚠️
...pache/cloudstack/oauth2/OAuth2AuthManagerImpl.java	60.00%	4 Missing and 2 partials ⚠️
...g/apache/cloudstack/oauth2/vo/OauthProviderVO.java	75.00%	3 Missing ⚠️
...tack/oauth2/api/command/ListOAuthProvidersCmd.java	0.00%	1 Missing ⚠️
...cloudstack/oauth2/google/GoogleOAuth2Provider.java	80.00%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## main #13033 +/- ##
============================================
+ Coverage 18.03% 18.90% +0.86% - Complexity 16648 18243 +1595 
============================================
Files 6035 6175 +140 Lines 542487 555372 +12885 Branches 66477 67787 +1310 ============================================
+ Hits 97854 104978 +7124 - Misses 433612 438864 +5252 - Partials 11021 11530 +509

Flag	Coverage Δ
uitests	`3.53% <ø> (+<0.01%)`	⬆️
unittests	`20.10% <59.60%> (+0.90%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

Adds Keycloak as an additional OAuth2/OIDC provider by extending the OAuth provider model/API/schema and exposing new provider URL fields in the UI, along with a new Keycloak authenticator implementation and tests.

Changes:

Add authorizeurl and tokenurl fields end-to-end (DB schema, VO/response objects, API commands, and UI config/i18n).
Register a new KeycloakOAuth2Provider and include it in the default provider order.
Update GitHub token exchange to use a configurable token URL instead of a hardcoded endpoint.

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
ui/src/views/auth/Login.vue	Adds Keycloak social login button and consumes `authorizeurl` from `listOauthProvider`.
ui/src/config/section/config.js	Extends OAuth provider UI config to edit/display `authorizeurl`/`tokenurl` and adds `keycloak` to provider options.
ui/public/locales/en.json	Adds UI labels for `Authorize URL` and `Token URL`.
ui/public/assets/keycloak.svg	Adds Keycloak icon asset for the login UI.
plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java	Introduces unit tests for the new Keycloak provider.
plugins/user-authenticators/oauth2/src/main/resources/META-INF/cloudstack/oauth2/spring-oauth2-context.xml	Registers Keycloak provider bean and adds it to default ordering.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/vo/OauthProviderVO.java	Adds `authorizeUrl` and `tokenUrl` columns/fields to the OAuth provider entity.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java	Implements Keycloak OAuth2/OIDC flow using token endpoint + ID token parsing.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java	Minor refactor/cleanup and fixes a format string.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/github/GithubOAuth2Provider.java	Switches GitHub token endpoint to DB-configured `tokenUrl`.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java	Extends API response to include `authorizeurl` and `tokenurl`.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/UpdateOAuthProviderCmd.java	Adds new parameters and returns them in response.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java	Adds new parameters and validates Keycloak requires the URLs.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java	Includes new URL fields in list responses.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java	Plumbs new URL fields through register/update persistence.
plugins/user-authenticators/oauth2/pom.xml	Adds CXF JOSE dependency used for JWT parsing.
engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql	Adds `authorize_url` and `token_url` columns to `cloud.oauth_provider`.
api/src/main/java/org/apache/cloudstack/api/ApiConstants.java	Adds API constants for `authorizeurl` and `tokenurl`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

blueorangutan · 2026-04-16T05:40:11Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17513

DaanHoogland · 2026-04-16T07:23:47Z

thanks for the contribution @tazouxme , looks useful. Please have a look at co-pilot’s comments and the pre-commit and license check failures.

kiranchavala · 2026-04-16T08:29:13Z

Looks very useful feature. Thanks for Contributing @tazouxme

Will test it out, I had previously tested saml authentication with keycloak

https://kiranchavala.in/blog/cloudstack-integration-with-keycloak/

tazouxme · 2026-04-17T07:51:10Z

Thanks for your positive feedback. There's only a valid point from Copilot regarding the Token validation. Signature should be validated but currently not done for Google / Github. Should this be introduced ?

DaanHoogland · 2026-04-17T09:11:50Z

Thanks for your positive feedback. There's only a valid point from Copilot regarding the Token validation. Signature should be validated but currently not done for Google / Github. Should this be introduced ?

If you feel like implementing it, your efforts are appreciated. I think it can be a separate PR.

github-actions · 2026-04-30T03:29:43Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

winterhazel · 2026-06-09T13:53:21Z

@blueorangutan package

blueorangutan · 2026-06-09T13:58:05Z

@winterhazel a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-06-09T14:51:20Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18206

DaanHoogland · 2026-06-16T06:14:46Z

@blueorangutan test

blueorangutan · 2026-06-16T06:16:04Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2026-06-16T21:17:59Z

[SF] Trillian test result (tid-16325)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 51059 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13033-t16325-kvm-ol8.zip
Smoke tests completed. 151 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

DaanHoogland · 2026-06-18T08:08:56Z

@weizhouapache @winterhazel , I will not have time to test this, but I think given the submitters testing we can add this as an experimental feature.

weizhouapache · 2026-06-18T08:32:20Z

@weizhouapache @winterhazel , I will not have time to test this, but I think given the submitters testing we can add this as an experimental feature.

@DaanHoogland
I will have a look.
cc @harikrishna-patnala

weizhouapache · 2026-06-18T08:50:03Z

@blueorangutan package

blueorangutan · 2026-06-18T08:52:05Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-06-18T09:36:58Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18296

DaanHoogland · 2026-06-19T06:53:32Z

@tazouxme , note we are about to merge #12702 it might require you to deal with some interface enhancements.

paratpanu18 · 2026-06-20T16:51:16Z

@tazouxme Thanks for your amazing work, It what I am looking for!

Btw, Do you think this will also works with other OAuth provider (e.g. Authentik)? I am looking to try on my own setup.

DaanHoogland · 2026-06-21T14:21:29Z

@blueorangutan test

blueorangutan · 2026-06-21T14:22:03Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2026-06-21T15:04:00Z

[SF] Trillian Build Failed (tid-16380)

tazouxme · 2026-06-22T11:02:33Z

@tazouxme Thanks for your amazing work, It what I am looking for!
Btw, Do you think this will also works with other OAuth provider (e.g. Authentik)? I am looking to try on my own setup.

Thanks for your feedback!
Should be tested with other provider, but it's pretty generic so it may work. Scopes are hard coded (openid and email). Make sure you don't need more user's data :)

blueorangutan · 2026-06-22T22:52:10Z

[SF] Trillian test result (tid-16385)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 56350 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13033-t16385-kvm-ol8.zip
Smoke tests completed. 151 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

weizhouapache

verified OK.

URLs are a bit different as @tazouxme

weizhouapache · 2026-06-23T11:58:46Z

@tazouxme
can you please create a doc PR in apache/cloudstack-document repo ?

weizhouapache · 2026-06-23T12:01:50Z

merging based on approvals, manual verification and smoke test results

boring-cyborg · 2026-06-23T12:02:04Z

Awesome work, congrats on your first merged pull request!

weizhouapache · 2026-06-24T12:16:26Z

@tazouxme can you please create a doc PR in apache/cloudstack-document repo ?

@tazouxme

tazouxme · 2026-06-24T12:24:25Z

@tazouxme can you please create a doc PR in apache/cloudstack-document repo ?
@tazouxme

@weizhouapache
As soon as time permits :)
Can you confirm this is the page to be modified: https://github.com/apache/cloudstack-documentation/blob/main/source/adminguide/accounts.rst

weizhouapache · 2026-06-24T12:33:51Z

@tazouxme can you please create a doc PR in apache/cloudstack-document repo ?
@tazouxme
@weizhouapache As soon as time permits :) Can you confirm this is the page to be modified: https://github.com/apache/cloudstack-documentation/blob/main/source/adminguide/accounts.rst

yes @tazouxme
thanks in advance

joel.tazzari added 6 commits April 15, 2026 07:45

Add Keycloak OAuth Provider: first commit
66d0344

Fix issue
c7c7297

Cache idToken
506f664

Fix variables
28ea821

Add labels
3d037ab

Change error message
a0270e1

boring-cyborgBot added component:api component:build component:UI labels Apr 15, 2026

sureshanaparti requested review from Copilot and harikrishna-patnala April 16, 2026 05:24

Copilotstarted reviewing on behalf of sureshanaparti April 16, 2026 05:25 View session

CopilotAI reviewed Apr 16, 2026
View reviewed changes

DaanHoogland reviewed Apr 16, 2026
View reviewed changes

Comment thread...s/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java

joel.tazzari added 4 commits April 17, 2026 09:06

Add Licence
63cc3bf

Fix bad change
beb64d4

Fix findings from Copilot review
cc18f82

pre-commit fix
1a543ae

github-actionsBot added the status:has-conflicts label Apr 30, 2026

Merge branch 'main' into feature/add_keycloak_oauth_provider
9df0c38

github-actionsBot mentioned this pull request Jun 9, 2026
[repo-status] Daily Status Report – June 9, 2026 #13386
Closed

weizhouapache closed this Jun 18, 2026

weizhouapache reopened this Jun 18, 2026

weizhouapache approved these changes Jun 23, 2026
View reviewed changes

weizhouapache merged commit c2c855b into apache:mainJun 23, 2026
49 of 69 checks passed

weizhouapache mentioned this pull request Jun 23, 2026
Add per-domain OAuth (Google, GitHub) provider support #12702
Merged
9 tasks

Uh oh!

Conversation

tazouxme commented Apr 15, 2026

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Screenshots (if appropriate):

How Has This Been Tested?

Uh oh!

boring-cyborgBot commented Apr 15, 2026

Uh oh!

sureshanaparti commented Apr 16, 2026

Uh oh!

blueorangutan commented Apr 16, 2026

Uh oh!

codecovBot commented Apr 16, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

blueorangutan commented Apr 16, 2026

Uh oh!

Uh oh!

DaanHoogland commented Apr 16, 2026

Uh oh!

kiranchavala commented Apr 16, 2026

Uh oh!

tazouxme commented Apr 17, 2026

Uh oh!

DaanHoogland commented Apr 17, 2026

Uh oh!

github-actionsBot commented Apr 30, 2026

Uh oh!

winterhazel commented Jun 9, 2026

Uh oh!

blueorangutan commented Jun 9, 2026

Uh oh!

blueorangutan commented Jun 9, 2026

Uh oh!

DaanHoogland commented Jun 16, 2026

Uh oh!

blueorangutan commented Jun 16, 2026

Uh oh!

blueorangutan commented Jun 16, 2026

Uh oh!

DaanHoogland commented Jun 18, 2026

Uh oh!

weizhouapache commented Jun 18, 2026

Uh oh!

weizhouapache commented Jun 18, 2026

Uh oh!

blueorangutan commented Jun 18, 2026

Uh oh!

blueorangutan commented Jun 18, 2026

Uh oh!

DaanHoogland commented Jun 19, 2026

Uh oh!

paratpanu18 commented Jun 20, 2026

Uh oh!

DaanHoogland commented Jun 21, 2026

Uh oh!

blueorangutan commented Jun 21, 2026

Uh oh!

blueorangutan commented Jun 21, 2026

Uh oh!

codecovBot commented Apr 16, 2026•
edited
Loading