How to configure Keycloak as login method for LXD¶

Keycloak is a self-hosted open source tool for authentication. Keycloak supports OIDC and can be used to authenticate users for LXD UI and CLI. This guide shows you how to set up Keycloak as the login method for LXD.

Using Keycloak to access LXD¶

Set up Keycloak. For this guide, it is assumed that Keycloak is available over HTTPS.
- If you already have Keycloak installed, follow their guide on configuring Keycloak for production.
- Alternatively, run the development version:
  - Download Keycloak-25.0.4.
  - Extract the files and run bin/kc.sh start-dev.
  - Open http://localhost:8080 in your browser and create an admin user with a password.
Open the Keycloak Admin Console. For the development version, you can access this at http://localhost:8080/admin. Sign in with the admin user that you created.
From the Keycloak dropdown in the top left corner of the Admin Console, select Create realm. Enter a Realm name, such as lxd-ui-realm, then click Create.
From the main navigation, select Clients, then click Create client. Enter a Client ID, such as lxd-ui-client, then click Next.
Enable the OAuth 2.0 Device Authorization Grant to allow the LXD CLI login. Click Next.
In the field for Valid redirect URIs, enter your LXD UI address, followed by /oidc/callback.
- Example: https://example.com:8443/oidc/callback
- An IP address can be used instead of a domain name.
- Note :8443 is the default listening port for the LXD server. It might differ for your setup. You can verify the LXD configuration value core.https_address to find the correct port for your LXD server.
Click Save.
From the main navigation, select Users, then click Create new user. Enter a Username, then click Create.
Select the Credentials tab for the new user and click Set password. Save the new password.
Configure the issuer on your LXD server via the CLI. For <keycloak-realm>, use the name that you created in step 2. For the <keycloak-frontend-url>, use the URL for your Keycloak server, such as http://192.0.2.1:8080. If you are running the development version of Keycloak, use http://localhost:8080.
```
lxc config set oidc.issuer=<keycloak-frontend-url>/realms/<keycloak-realm>
```
Configure the client in LXD with the command below. Use the client id from step 4.
```
lxc config set oidc.client.id=<keycloak-client-id>.
```

Now you can access the LXD UI with any browser and use SSO login. To use OIDC on the LXD CLI, run lxc remote add <LXD address> --auth-type oidc and follow the instructions to authenticate.

Users authenticated through Keycloak have no default permissions in the LXD UI. Set up LXD authorization groups to grant access to projects and instances and map a LXD authorization group to the user. Note that the user object in LXD is only created on the first login of that user to LXD.