求基于Keycloak OIDC的极简Flask登录页面实现示例

前置准备 #

Keycloak端配置 #

• 登录Keycloak后台，进入目标Realm（无则新建）
• 创建客户端：
  • 客户端ID：flask-app
  • 访问类型：confidential
  • 有效重定向URI：http://testapp.mycompany.com/login/callback
  • Web Origins：http://testapp.mycompany.com
• 保存后，在「凭据」标签页复制客户端密钥

依赖安装 #

pip install flask authlib requests

Flask核心代码 #

from flask import Flask, redirect, url_for, session, render_template_string
from authlib.integrations.flask_client import OAuth

app = Flask(__name__)
app.secret_key = "your-secure-random-secret"  # 生产环境需用强随机密钥

# 初始化OAuth客户端
oauth = OAuth(app)

# 配置Keycloak OIDC
keycloak = oauth.register(
    name='keycloak',
    client_id='flask-app',  # 对应Keycloak客户端ID
    client_secret='your-keycloak-client-secret',  # 替换为实际客户端密钥
    server_metadata_url='https://auth.mycompany.com/realms/你的Realm名称/.well-known/openid-configuration',
    client_kwargs={
        'scope': 'openid email profile'
    }
)

# 首页：未登录显示入口，已登录展示用户信息
@app.route('/')
def index():
    user = session.get('user')
    if user:
        return render_template_string('''
            <h1>已登录</h1>
            <p>用户名: {{ user.preferred_username }}</p>
            <p>邮箱: {{ user.email }}</p>
            <a href="/logout">退出登录</a>
        ''', user=user)
    return '<h1>未登录</h1><a href="/login">点击登录</a>'

# 登录跳转：导向Keycloak授权页
@app.route('/login')
def login():
    redirect_uri = url_for('auth_callback', _external=True)
    return keycloak.authorize_redirect(redirect_uri)

# 授权回调：获取并存储用户信息
@app.route('/login/callback')
def auth_callback():
    token = keycloak.authorize_access_token()
    user = keycloak.parse_id_token(token)
    session['user'] = user
    return redirect('/')

# 退出登录：清除会话并跳转到Keycloak登出页
@app.route('/logout')
def logout():
    session.clear()
    logout_url = 'https://auth.mycompany.com/realms/你的Realm名称/protocol/openid-connect/logout'
    return redirect(f'{logout_url}?redirect_uri=http://testapp.mycompany.com')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80, debug=True)

运行说明 #

1. 替换代码中your-secure-random-secret、your-keycloak-client-secret、你的Realm名称为实际值
2. 启动服务：python app.py
3. 访问http://testapp.mycompany.com即可触发完整登录流程

前置准备 #

Keycloak端配置 #

同Flask部分，客户端ID设为django-app，有效重定向URI设为http://testapp.mycompany.com/accounts/keycloak/login/callback/

依赖安装 #

pip install django django-allauth

Django配置步骤 #

1. 创建项目：django-admin startproject keycloak_demo
2. 编辑keycloak_demo/settings.py，修改INSTALLED_APPS与认证配置：

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'django.contrib.sites',
    'allauth',
    'allauth.account',
    'allauth.socialaccount',
    'allauth.socialaccount.providers.openid_connect',
]

SITE_ID = 1

AUTHENTICATION_BACKENDS = [
    'django.contrib.auth.backends.ModelBackend',
    'allauth.account.auth_backends.AuthenticationBackend',
]

# Keycloak OIDC配置
SOCIALACCOUNT_PROVIDERS = {
    'openid_connect': {
        'SERVERS': [
            {
                'id': 'keycloak',
                'name': 'Keycloak',
                'server_url': 'https://auth.mycompany.com/realms/你的Realm名称/.well-known/openid-configuration',
                'client_id': 'django-app',
                'secret': 'your-keycloak-client-secret',
                'scope': ['openid', 'email', 'profile'],
            }
        ]
    }
}

LOGIN_REDIRECT_URL = '/'
LOGOUT_REDIRECT_URL = '/'

3. 编辑keycloak_demo/urls.py：

from django.contrib import admin
from django.urls import path, include

urlpatterns = [
    path('admin/', admin.site.urls),
    path('accounts/', include('allauth.urls')),
    path('', include('django.contrib.auth.urls')),
]

4. 创建登录模板templates/registration/login.html：

<h1>登录</h1>
<a href="{% provider_login_url 'openid_connect' openid='keycloak' %}">使用Keycloak登录</a>

5. 初始化数据库：

python manage.py migrate

运行说明 #

1. 替换配置中你的Realm名称、your-keycloak-client-secret为实际值
2. 启动服务：python manage.py runserver 0.0.0.0:80
3. 访问http://testapp.mycompany.com/accounts/login/即可触发登录流程

内容的提问来源于stack exchange，提问作者Sauce