How do I integrate Keycloak into third-party applications?

Summary

By default, you cannot integrate Keycloak into any third-party app. In Keycloak, embedding Keycloak and Keycloak authentication in other websites via iFrame is prevented.

The two headers Content-Security-Policy and X-Frame-Options prevent embedding.

However, if you want to integrate Keycloak into another application, you must adjust the values of the two headers.

Important requirements

You have administrative permissions in Keycloak.

Solution

Suppose you want to integrate an edoc automate app as a context action into the web application d.velop documents, which is executed under d-velop.<mySite>.local.

You must adjust the headers in Keycloak under Realm Settings > Security Defenses:

1. In the Content-Security-Policy header, add the value frame-ancestors 'self' to https://d-velop.<mySite>.local.

2. In the X-Frame-Options header, add the value ALLOW-FROM with https://d-velop.<mySite>.local.

You can then carry out the integration of your edoc automate app.