Gitea: Single Sign-On with OAuth2 provider (Keycloak) is not login single sign-on

[devent]

• Gitea version (or commit ref): 1.4.1
• Git version: 2.15.0
• Operating system: Debian Linux
• Database (use [x]):
  
  
  
  • [x] PostgreSQL
  
  
  • [ ] MySQL
  
  
  • [ ] MSSQL
  
  
  • [ ] SQLite
  
  
• Can you reproduce the bug at https://try.gitea.io:
  
  
  
  • [ ] Yes (provide example URL)
  
  
  • [x] No
  
  
  • [ ] Not relevant
  
  
• Log gist:

Description

I'm using Keycloak as a SSO solution and have configured Gitea to use OAuth2 authentication. That works fine. I have also Jenkins using the same SSO solution.

The problem is that if I login into Jenkins as the same user then I'm not logged in in Gitea. I was thinking that in SSO Keycloak I only need to be logged in once in any application and it will logged me everywhere. I need to login separately in Gitea.

After I click on Sign In and Sign In Using Openid Connect I'm logged in without password.

Is that the expected behavior?

My expectation would be that after I logged in into Jenkins then I'm also automatically logged in into Gitea without the need to click on Sign In Using Openid Connect.
...

Screenshots

[lafriks]

Gitea can not possibility know and should not know about other sessions you have with this SSO. So you still have to click sign in in gitea just like if you would first sign in in gitea and later you would still be required to sing in into Jenkins. You should not be asked for password when signing in tho

[devent]

Then I had the wrong idea what SSO means. Thank you. Yes, I don't need to enter any password to login in Gitea if I'm already logged in into Jenkins.

[CRCinAU]

I know this is a bit off topic - but is there any link to how to configure gitea to use keycloak as an auth source? My Google-foo has turned up nothing :(

[devent]

If I remember correctly, you just add in the config:

    [openid]
    ENABLE_OPENID_SIGNIN = true
    ENABLE_OPENID_SIGNUP = false

After that you can configure the OpenID in Gitea itself.