How to use third party authentication providers with formsflow.ai?

[sreehari-aot]

currently, the Keycloak token is used for authentication within formsflow.ai components, for any integrations with an existing authentication provider other than Keycloak what would be the recommended approach?

[sumesh-aot]

Keycloak is an essential part of the solution and cannot be replaced as the components integrate with keycloak for authentication and authorization. That being said, keycloak provides more flexibility in terms of brokering and federation which can be used by customers to integrate keycloak with their existing practice for authn/authz.
Keycloak provides below options for those extensions;

• Identity brokering : It refers to brokering the authentication to external identity providers which follows SAML or OIDC standards. Please read https://www.keycloak.org/docs/latest/server_admin/#_identity_broker for more details on how it works. Also the groups or authorizations as part of the identity can be mapped to keycloak from external identity provider (https://stackoverflow.com/questions/70974442/map-groups-to-roles-in-keycloak-when-using-oidc)
• User storage federation : Keycloak supports federating LDAP and Active Directory users for authentication. Also if the customer have a custom database with user credentials, then this can be extended using Keycloak User Storage SPI (details : https://www.keycloak.org/docs/latest/server_development/#_user-storage-spi) to support federation. Please read https://www.keycloak.org/docs/latest/server_admin/#_user-storage-federation for more details on how this works.
  Also there are options in keycloak to populate the group information from LDAP or AD to keycloak, so that the authentication can happen based on LDAP/AD and keycloak just uses the identity and groups coming from LDAP/AD. One such example can be seen here : https://www.janua.fr/mapping-ldap-group-and-roles-to-redhat-sso-keycloak/

If the customer have requirement to pull some additional details in to the token by connecting to any other external system after authentication, this can be done using custom protocol mapper. A complete example : https://github.com/mschwartau/keycloak-custom-protocol-mapper-example/blob/master/README.md