---
title: Apaceh2 oauth plugin
url: https://devopstales.github.io/sso/mod-auth-openidc/
date: 2019-05-13
keywords: Keycloak, oauth2, apache2, httpd, SSO, OIDC
---


Configure Apache plugin to use Keycloak as a user backend for login with OpenID and SSO.

&lt;!--more--&gt;
mod_auth_openidc is an OpenID Connect Relying Party implementation for Apache HTTP Server 2.x

### Install the plugin
```
yum install mod_auth_openidc httpd php mod_ssl -y

mkdir -p /var/www/html/oauth/protected
echo &#34;index&#34; &gt; /var/www/html/oauth/index.htm
```

```
nano /var/www/html/oauth/protected/index.php
&lt;!DOCTYPE html&gt;
&lt;html lang=&#34;en&#34;&gt;

&lt;head&gt;

   &lt;meta charset=&#34;utf-8&#34;&gt;
   &lt;meta http-equiv=&#34;X-UA-Compatible&#34; content=&#34;IE=edge&#34;&gt;
   &lt;meta name=&#34;viewport&#34; content=&#34;width=device-width, initial-scale=1&#34;&gt;
   &lt;meta name=&#34;description&#34; content=&#34;&#34;&gt;
   &lt;meta name=&#34;author&#34; content=&#34;&#34;&gt;

   &lt;title&gt;OpenID Connect: Received Claims&lt;/title&gt;

&lt;/head&gt;

&lt;body&gt;
         &lt;h3&gt;
            Claims sent back from OpenID Connect via the Apache module
         &lt;/h3&gt;
         &lt;br/&gt;


   &lt;!-- OpenAthens attribtues --&gt;
      &lt;?php session_start(); ?&gt;

         &lt;h2&gt;Claims&lt;/h2&gt;
         &lt;br/&gt;
         &lt;div class=&#34;row&#34;&gt;

               &lt;table class=&#34;table&#34; style=&#34;width:80%;&#34; border=&#34;1&#34;&gt;
                 &lt;?php foreach ($_SERVER as $key=&gt;$value): ?&gt;
                    &lt;?php if ( preg_match(&#34;/OIDC_/i&#34;, $key) ): ?&gt;
                       &lt;tr&gt;
                          &lt;td data-toggle=&#34;tooltip&#34; title=&lt;?php echo $key; ?&gt;&gt;&lt;?php echo $key; ?&gt;&lt;/td&gt;
                          &lt;td data-toggle=&#34;tooltip&#34; title=&lt;?php echo $value; ?&gt;&gt;&lt;?php echo $value; ?&gt;&lt;/td&gt;
                       &lt;/tr&gt;
                    &lt;?php endif; ?&gt;
                 &lt;?php endforeach; ?&gt;
               &lt;/table&gt;

&lt;/body&gt;&lt;/html&gt;
```

### Create vhost
```
nano /etc/httpd/conf.d/aouth-site.conf
# NameVirtualHost *:80
&lt;VirtualHost *:80&gt;
   ServerName oauth.devopstales.intra
   DocumentRoot /var/www/oauth/
   Redirect permanent / https://oauth.devopstales.intra
&lt;/VirtualHost&gt;

&lt;VirtualHost *:443&gt;
    ServerAdmin webmaster@example.com
    ServerName oauth.devopstales.intra
    ServerAlias www.oauth.devopstales.intra
    DocumentRoot /var/www/html/oauth/
    DirectoryIndex index.html index.php
    ErrorLog /var/log/httpd/oauth-error.log
    CustomLog /var/log/httpd/oauth-access.log combined

    SSLEngine on
    SSLCertificateFile /etc/httpd/ssl/domain.pem
    SSLCertificateKeyFile /etc/httpd/ssl/domain.pem
    SSLCertificateChainFile /etc/httpd/ssl/domain.pem

    # keycloak server
    OIDCProviderMetadataURL http://sso.devopstales.intra/auth/realms/mydomain/.well-known/openid-configuration
    # for self signed certificate
    OIDCSSLValidateServer Off
    OIDCClientID web
    OIDCClientSecret 5b721a2b-681f-402d-807c-b98c80672c16
    OIDCRedirectURI http://oauth.devopstales.intra/protected/redirect_uri
    OIDCCryptoPassphrase passphrase
    OIDCJWKSRefreshInterval 3600

    &lt;Location /protected/&gt;
       AuthType openid-connect
       Require valid-user
    &lt;/Location&gt;

&lt;/VirtualHost&gt;
```

### Start apache
```
systemct start httpd
```