Keycloak OpenID Connect identity provider and mappers
Sign-in with Dazr Identity: free OpenID Connect, hosted in the EU, with passkeys, email codes and Google or Microsoft accounts behind one button.
You need three values from the developer console: the client ID, the client secret (web server apps only) and the redirect URI you registered. Everything else comes from the discovery document at https://identity.dazr.eu/.well-known/openid-configuration.
Keycloak (identity brokering)
If your apps already sign in through Keycloak, add Dazr Identity as an identity provider. Keycloak then shows “Sign in with Dazr Identity” on its own login page and your apps keep talking to Keycloak. In the Keycloak admin console of your realm, open Identity providers, add OpenID Connect v1.0 and fill in:
| Setting | Value |
|---|---|
| Alias | dazr (the redirect URI to register at Dazr is https://keycloak.example.eu/realms/<realm>/broker/dazr/endpoint) |
| Display name | Dazr Identity |
| Discovery endpoint | https://identity.dazr.eu/.well-known/openid-configuration |
| Client authentication | Client secret sent as basic auth |
| Client ID and Client secret | from the Dazr developer console (web server app) |
| Use PKCE | on, method S256 |
| Validate signatures | on, with Use JWKS URL on and JWKS URL https://identity.dazr.eu/oauth/jwks |
| Scopes | openid profile email, plus organisations if you map organisations below |
| Backchannel logout | off: Dazr Identity has no back-channel logout. Sign-out goes through the browser to https://identity.dazr.eu/oauth/logout. |
| Disable user info | off: the mappers below read the user info response |
| Trust email | on: Dazr only issues verified email addresses |
| Sync mode | Force, so names and roles are updated at every sign-in |
Keycloak keys the brokered account on the Dazr sub. Set the first login flow to link existing Keycloak users by email only if your realm verifies email addresses itself.
Map organisations and roles
When Keycloak brokers Dazr Identity (see the Keycloak guide), add mappers under the identity provider’s Mappers tab, with sync mode Force. Keycloak reads these paths from the user info response, and a path can name one position in a list: organisations[0] is the first organisation the person ticked. For a portal with one customer account per person that is enough; if people work for several organisations, let them tick one, or read the full list in your app.
| Mapper type | Claim | Result |
|---|---|---|
| Attribute Importer | organisations[0].id | User attribute dazr_org_id: the tenant key |
| Attribute Importer | organisations[0].name | User attribute dazr_org_name |
| Claim to Role | organisations[0].role, claim value owner | Realm or client role tenant_admin |
| Claim to Role | organisations[0].role, claim value admin | Realm or client role tenant_admin |
| Claim to Role | organisations[0].role, claim value member | Realm or client role tenant_user |
| Claim to Role | organisations[0].verification.status, claim value verified | Role verified_business |
Then add a User Attribute mapper for dazr_org_id to your app’s client scope in Keycloak, so your app receives the tenant key in Keycloak’s own tokens, next to the roles.
sub claim is pairwise: the same for every app of your organisation, different for every other organisation. It never changes for a person, while an email address can. Store sub as the account key and treat email as contact data.
More for developers
Developer docsAll integration guidesAny OpenID Connect libraryPricing