Keycloak SSO not possible with docker image ?

[SpiderD555]

Hi all,
I am trying to connect my docker nautobot instance 1.5.11-py3.10 with Keycloak, but I am not sure if I pass the correct local.env variables.
As per the official nautobot SSO documentation I should be referring to this page for details, but when I add needed environment variables, then I still can't use /login/keycloak url endpoint ("Page Not Found" is what I get)

AUTHENTICATION_BACKENDS = [ "social_core.backends.keycloak.KeycloakOAuth2", "django.contrib.auth.backends.ModelBackend"]
SOCIAL_AUTH_KEYCLOAK_KEY = "nautobot"
SOCIAL_AUTH_KEYCLOAK_SECRET = "secret"
SOCIAL_AUTH_KEYCLOAK_PUBLIC_KEY = "secret"
SOCIAL_AUTH_KEYCLOAK_AUTHORIZATION_URL = "https://myurl/realms/myrealm/protocol/openid-connect/auth"
SOCIAL_AUTH_KEYCLOAK_ACCESS_TOKEN_URL = "https://myurl/realms/myrealm/protocol/openid-connect/token"

SSO instruction says to adjust nautobot_config.py, but I was hoping that I could do it without messing around with base nautobot docker images and just pass needed variables in local.env. Is my thinking wrong here or is just the docker image not the right way to go with SSO ? Or maybe I should be just using generic OIDC endpoint instead ?

[SpiderD555]

With a bit of tinkering I managed to create a Docker file which is compatible with Keycloak SSO

1. Configure Keycloak according to social auth page tutorial
2. Create a Docker file. Keep note that your URLs may be different. It is best to use https://{oauth-provider-hostname}/.well-known/openid-configuration OIDC endpoint to get them all:

ARG PYTHON_VER=3.10
ARG NAUTOBOT_VERSION=1.5.11
FROM networktocode/nautobot:${NAUTOBOT_VERSION}-py${PYTHON_VER}

# ---------------------------------
# Stage: Builder
# ---------------------------------

RUN echo 'AUTHENTICATION_BACKENDS = [ "social_core.backends.keycloak.KeycloakOAuth2", "nautobot.core.authentication.ObjectPermissionBackend", "django.contrib.auth.backends.ModelBackend" ]' >> /opt/nautobot/nautobot_config.py
RUN echo "SOCIAL_AUTH_KEYCLOAK_KEY = 'nautobot'" >> /opt/nautobot/nautobot_config.py
RUN echo "SOCIAL_AUTH_KEYCLOAK_SECRET = 'mysecret'" >> /opt/nautobot/nautobot_config.py
RUN echo "SOCIAL_AUTH_KEYCLOAK_PUBLIC_KEY = 'mypublickey'" >> /opt/nautobot/nautobot_config.py
RUN echo "SOCIAL_AUTH_KEYCLOAK_AUTHORIZATION_URL = 'https://keycloak.example.net/realms/myrealm/protocol/openid-connect/auth'" >> /opt/nautobot/nautobot_config.py
RUN echo "SOCIAL_AUTH_KEYCLOAK_ACCESS_TOKEN_URL = 'https://keycloak.example.net/realms/myrealm/protocol/openid-connect/token'" >> /opt/nautobot/nautobot_config.py
#RUN echo 'AUTHENTICATION_BACKENDS = [ "social_core.backends.open_id.OpenIdAuth", "nautobot.core.authentication.ObjectPermissionBackend" ]' >> /opt/nautobot/nautobot_config.py
#RUN echo "SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = 'https://keycloak.example.net'" >> /opt/nautobot/nautobot_config.py
#RUN echo "SOCIAL_AUTH_OIDC_KEY = 'nautobot'" >> /opt/nautobot/nautobot_config.py
#RUN echo "SOCIAL_AUTH_OIDC_SECRET = 'myoidcsecret'" >> /opt/nautobot/nautobot_config.py

3. Build new image. Keep note spiderd555 is my user name, you can use your own here:
   docker build -t spiderd555/nautobot:1.5.11-py3.10 .
4. Edit docker-compose file and swap all nautobot image names with "spiderd555/nautobot:1.5.11-py3.10". Use the name from step 3
5. SSO will work (kind of)
   The problem now is creating proper credential scopes in Keycloak. I only managed to make the SSO login work, but Keycloak requires authorization configuration to let user do anything in Nautobot at all, by default all options in Nautobot will be greyed-out. Maybe someone will take it from there and make some guide what to do on Keycloak side to make it work