VCF 9.0 Single Sign-On with Keycloak as OIDC Identity Provider (Lab Guide, incl. Certificate Chain Upload)

Configure Keycloak as the OIDC identity provider for VCF 9.0 Single Sign-On in a lab: realm, client, groups claim, and the PEM certificate chain upload.

Short answer: Keycloak is not on Broadcom’s list of supported identity providers for VCF Single Sign-On, but because it speaks standard OpenID Connect it works well in a lab. Create a realm and a confidential OIDC client in Keycloak, add a groups claim, then run the VCF Operations SSO wizard with the OIDC flow, paste the client ID, secret, discovery URL and the full PEM certificate chain of the Keycloak HTTPS endpoint, and use JIT provisioning.

Is Keycloak supported for VCF SSO?

No. The Broadcom page Identity Providers and Protocols Supported for VCF Single Sign-On lists Okta, Ping Identity, Microsoft Entra ID, Microsoft ADFS, any SAML 2.0 IdP, and AD/LDAP or OpenLDAP. Keycloak is not named. Treat everything below as lab / proof-of-concept only; for production use one of the listed IdPs.

VCF SSO itself is configured in VCF Operations > Fleet Management > Identity & Access. It is delivered by the VCF Identity Broker, which runs either embedded in the management domain vCenter or as a separate appliance, and it covers vCenter, NSX, VCF Operations, VCF Automation and the other VCF Operations components (not SDDC Manager or ESX), per Configuring VCF Single Sign-On.

Prepare Keycloak

  1. Run Keycloak behind HTTPS with a certificate issued by a CA you control. VCF requires the OIDC endpoint to be served over HTTPS.
  2. Create a dedicated realm, for example vcf, and the lab users.
  3. Create an OpenID Connect client (for example vcf-sso) with Client authentication enabled, so Keycloak issues a client secret. You will add the redirect URI later, because the VCF wizard generates it.
  4. Create a group (for example vcf-admins) and put your admin users into it.
  5. In the client’s dedicated client scope add a Group Membership mapper with token claim name groups and Full group path switched off, so the claim contains vcf-admins rather than /vcf-admins.
  6. Make sure users have username, email, first name and last name filled in.

Broadcom’s OIDC procedures list the claims VCF expects by default (case-sensitive): preferred_username, email, family_name, given_name, groups and domain. Keycloak’s default profile and email scopes provide the first four; groups comes from the mapper above. If your claim names differ, map them on the Identity & Access page in VCF Operations.

The discovery URL (VCF calls it OpenID Address) is shown in Keycloak under Realm settings > Endpoints > OpenID Endpoint Configuration and has this form:

https://keycloak.lab.local/realms/vcf/.well-known/openid-configuration

Run the VCF SSO wizard

Because Keycloak has no dedicated template, pick a listed IdP that offers OIDC. Lab write-ups (including William Lam’s, credited below) use the Ping Identity OIDC path, whose screen accepts a custom SSL certificate. The fields, per Broadcom’s Configure Ping Identity as an Identity Provider Using OIDC:

VCF fieldValue from Keycloak
IDP Display NameAny label, e.g. Keycloak Lab
Client IdentifierClient ID, e.g. vcf-sso
Shared secretClients > vcf-sso > Credentials > Client secret
OpenID AddressThe .well-known/openid-configuration URL
Redirect URIGenerated by VCF: copy it into the Keycloak client’s Valid redirect URIs
SSL CertificatePEM certificate chain of the Keycloak HTTPS endpoint

For user and group provisioning, VCF offers SCIM, JIT or AD/LDAP. With Keycloak in a lab, JIT is the simple choice: users are created at first login, and you can pre-provision the vcf-admins group so you can grant it permissions before anyone logs in.

Uploading the certificate chain (leaf, intermediate, root)

This is where most lab setups fail. Broadcom requires the certificate in PEM format, including the BEGIN CERTIFICATE and END CERTIFICATE lines. Provide the full chain of trust for the Keycloak endpoint, not only the leaf. Concatenate the PEM blocks in the usual TLS order, leaf first, then intermediate(s), then the root:

cat keycloak-leaf.pem intermediate-ca.pem root-ca.pem > keycloak-chain.pem

# check what Keycloak actually serves
openssl s_client -connect keycloak.lab.local:443 -showcerts </dev/null
  • The leaf certificate’s SAN must contain the FQDN used in the OpenID Address.
  • Use PEM (Base64) text, not DER or PKCS#12.
  • Keycloak should also serve the intermediate in its TLS handshake; openssl s_client shows whether it does.

After the IdP is configured

  1. Assign permissions to the Keycloak group in vCenter (for example Administrator on the root object). Without a role, SSO login succeeds but the user sees nothing.
  2. Enable SSO for the other components (NSX Manager, VCF Operations, VCF Automation) in the Identity & Access workflow.
  3. Log in through the new IdP button and confirm the groups claim is mapped.

If you rebuild labs often, the whole flow can be scripted. See VCF 9.1: automating VCF Single Sign-On (SSO) with an OIDC IdP. For a small lab footprint, see Deploying a minimal VCF 9.0 lab.

Further reading

Author: Daniel Micanek

Senior Service Architect, SAP/TDL Platform Services Team at Vivicta | vExpert ⭐⭐⭐⭐⭐⭐⭐ | Broadcom Knight: vSphere Kubernetes Service, VCF Networking (NSX), VCF Automation | Broadcom Software Knight: vSphere | Cisco Champion. Notes from running about 1,000 ESXi hosts on Cisco UCS, VCF 9 and SAP HANA on vSphere.