Add keycloak OAuth provider by tazouxme · Pull Request #13033 · apache/cloudstack

tazouxme · 2026-04-15T19:11:57Z

Description

Add Keycloak as a new OAuth provider. This PR adds two new fields in the UI and in the DB:

Authorization URL
Token URL

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Screenshots (if appropriate):

How Has This Been Tested?

Manual testing using local Keycloak instance with basic Realm

boring-cyborg · 2026-04-15T19:12:01Z

Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
Here are some useful points:

In case of a new feature add useful documentation (raise doc PR at https://github.com/apache/cloudstack-documentation)
Be patient and persistent. It might take some time to get a review or get the final approval from the committers.
Pay attention to the quality of your code, ensure tests are passing and your PR doesn't have conflicts.
Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Issues, Mailing list and Slack.
Be sure to read the CloudStack Coding Conventions.
Apache CloudStack is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@cloudstack.apache.org (https://cloudstack.apache.org/mailing-lists.html)
Slack: https://apachecloudstack.slack.com/

sureshanaparti · 2026-04-16T04:46:55Z

@blueorangutan package

blueorangutan · 2026-04-16T04:48:03Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

codecov · 2026-04-16T04:55:25Z

Codecov Report

❌ Patch coverage is 60.13514% with 59 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.05%. Comparing base (a73cc9a) to head (9df0c38).
⚠️ Report is 25 commits behind head on main.

Files with missing lines	Patch %	Lines
...dstack/oauth2/keycloak/KeycloakOAuth2Provider.java	78.20%	12 Missing and 5 partials ⚠️
...ack/oauth2/api/response/OauthProviderResponse.java	25.00%	12 Missing ⚠️
...k/oauth2/api/command/RegisterOAuthProviderCmd.java	15.38%	10 Missing and 1 partial ⚠️
...ack/oauth2/api/command/UpdateOAuthProviderCmd.java	0.00%	8 Missing ⚠️
...pache/cloudstack/oauth2/OAuth2AuthManagerImpl.java	60.00%	4 Missing and 2 partials ⚠️
...g/apache/cloudstack/oauth2/vo/OauthProviderVO.java	75.00%	3 Missing ⚠️
...tack/oauth2/api/command/ListOAuthProvidersCmd.java	0.00%	1 Missing ⚠️
...cloudstack/oauth2/google/GoogleOAuth2Provider.java	80.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #13033      +/-   ##
============================================
+ Coverage     18.03%   18.05%   +0.01%     
- Complexity    16648    16667      +19     
============================================
  Files          6035     6036       +1     
  Lines        542487   542630     +143     
  Branches      66477    66489      +12     
============================================
+ Hits          97854    97959     +105     
- Misses       433612   433642      +30     
- Partials      11021    11029       +8

Flag	Coverage Δ
uitests	`3.52% <ø> (-0.01%)`	⬇️
unittests	`19.21% <60.13%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

Adds Keycloak as an additional OAuth2/OIDC provider by extending the OAuth provider model/API/schema and exposing new provider URL fields in the UI, along with a new Keycloak authenticator implementation and tests.

Changes:

Add authorizeurl and tokenurl fields end-to-end (DB schema, VO/response objects, API commands, and UI config/i18n).
Register a new KeycloakOAuth2Provider and include it in the default provider order.
Update GitHub token exchange to use a configurable token URL instead of a hardcoded endpoint.

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
ui/src/views/auth/Login.vue	Adds Keycloak social login button and consumes `authorizeurl` from `listOauthProvider`.
ui/src/config/section/config.js	Extends OAuth provider UI config to edit/display `authorizeurl`/`tokenurl` and adds `keycloak` to provider options.
ui/public/locales/en.json	Adds UI labels for `Authorize URL` and `Token URL`.
ui/public/assets/keycloak.svg	Adds Keycloak icon asset for the login UI.
plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java	Introduces unit tests for the new Keycloak provider.
plugins/user-authenticators/oauth2/src/main/resources/META-INF/cloudstack/oauth2/spring-oauth2-context.xml	Registers Keycloak provider bean and adds it to default ordering.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/vo/OauthProviderVO.java	Adds `authorizeUrl` and `tokenUrl` columns/fields to the OAuth provider entity.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java	Implements Keycloak OAuth2/OIDC flow using token endpoint + ID token parsing.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java	Minor refactor/cleanup and fixes a format string.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/github/GithubOAuth2Provider.java	Switches GitHub token endpoint to DB-configured `tokenUrl`.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java	Extends API response to include `authorizeurl` and `tokenurl`.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/UpdateOAuthProviderCmd.java	Adds new parameters and returns them in response.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java	Adds new parameters and validates Keycloak requires the URLs.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java	Includes new URL fields in list responses.
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java	Plumbs new URL fields through register/update persistence.
plugins/user-authenticators/oauth2/pom.xml	Adds CXF JOSE dependency used for JWT parsing.
engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql	Adds `authorize_url` and `token_url` columns to `cloud.oauth_provider`.
api/src/main/java/org/apache/cloudstack/api/ApiConstants.java	Adds API constants for `authorizeurl` and `tokenurl`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

blueorangutan · 2026-04-16T05:40:11Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17513

DaanHoogland · 2026-04-16T07:23:47Z

thanks for the contribution @tazouxme , looks useful. Please have a look at co-pilot’s comments and the pre-commit and license check failures.

kiranchavala · 2026-04-16T08:29:13Z

Looks very useful feature. Thanks for Contributing @tazouxme

Will test it out, I had previously tested saml authentication with keycloak

https://kiranchavala.in/blog/cloudstack-integration-with-keycloak/

tazouxme · 2026-04-17T07:51:10Z

Thanks for your positive feedback. There's only a valid point from Copilot regarding the Token validation. Signature should be validated but currently not done for Google / Github. Should this be introduced ?

DaanHoogland · 2026-04-17T09:11:50Z

Thanks for your positive feedback. There's only a valid point from Copilot regarding the Token validation. Signature should be validated but currently not done for Google / Github. Should this be introduced ?

If you feel like implementing it, your efforts are appreciated. I think it can be a separate PR.

github-actions · 2026-04-30T03:29:43Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

Copilot

Pull request overview

Copilot reviewed 17 out of 18 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

joel.tazzari added 6 commits April 15, 2026 07:45

Add Keycloak OAuth Provider: first commit

66d0344

Fix issue

c7c7297

Cache idToken

506f664

Fix variables

28ea821

Add labels

3d037ab

Change error message

a0270e1

boring-cyborg Bot added component:api component:build component:UI labels Apr 15, 2026

sureshanaparti requested review from Copilot and harikrishna-patnala April 16, 2026 05:24

Copilot started reviewing on behalf of sureshanaparti April 16, 2026 05:25 View session

Copilot AI reviewed Apr 16, 2026

View reviewed changes

DaanHoogland reviewed Apr 16, 2026

View reviewed changes

Comment thread ...s/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java

joel.tazzari added 4 commits April 17, 2026 09:06

Add Licence

63cc3bf

Fix bad change

beb64d4

Fix findings from Copilot review

cc18f82

pre-commit fix

1a543ae

github-actions Bot added the status:has-conflicts label Apr 30, 2026

Merge branch 'main' into feature/add_keycloak_oauth_provider

9df0c38

DaanHoogland requested a review from Copilot April 30, 2026 09:09

Copilot started reviewing on behalf of DaanHoogland April 30, 2026 09:10 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

github-actions Bot removed the status:has-conflicts label Apr 30, 2026

weizhouapache added this to the 4.23.0 milestone May 7, 2026

Review from Copilot

400bd09

Conversation

tazouxme commented Apr 15, 2026

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Screenshots (if appropriate):

How Has This Been Tested?

Uh oh!

boring-cyborg Bot commented Apr 15, 2026

Uh oh!

sureshanaparti commented Apr 16, 2026

Uh oh!

blueorangutan commented Apr 16, 2026

Uh oh!

codecov Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

blueorangutan commented Apr 16, 2026

Uh oh!

Uh oh!

DaanHoogland commented Apr 16, 2026

Uh oh!

kiranchavala commented Apr 16, 2026

Uh oh!

tazouxme commented Apr 17, 2026

Uh oh!

DaanHoogland commented Apr 17, 2026

Uh oh!

github-actions Bot commented Apr 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

codecov Bot commented Apr 16, 2026 •

edited

Loading