Establishing Federated Trust between Keycloak and Azure AD for Pipeline Deployments with Multiple Users

Question

Establishing Federated Trust between Keycloak and Azure AD for Pipeline Deployments with Multiple Users

Kaushik Ray 5

Scenario:

I have a Jenkins pipeline where users authenticate with Keycloak. I want to leverage this authentication to allow users to deploy resources in Azure using a service principal.

Keycloak Authentication: Users authenticate with Keycloak, and the pipeline obtains a valid access token.
Azure AD Integration: I have configured an app registration in Azure AD and a federated secret with issuer, subject, and audience to establish trust with Keycloak. This works for a single or couple of users where I add their subjects in federated secrets.
Service Principal Assumption: Upon successful authentication with Keycloak, the pipeline should assume the role of the service principal associated with the app registration.

Challenge:

Multiple Users: Since each Keycloak user has a unique subject in the access token, how can I configure the federated secret in Azure AD to accommodate all users within my team (100+ members)?
How to setup the App registration and federated secrets for all users(dynamic)
Is this the suggested use case to use federated identity for such cases ?

Kaushik Ray 5 Reputation points

2025-02-11T10:38:00.7266667+00:00

Hello Team,
Please advise on the suggested query.

1 answer

Your answer

Kaushik Ray 5 Reputation points

2025-02-11T10:38:00.7266667+00:00

Hello Team,
Please advise on the suggested query.

Answer 1

Venkata Jagadeep 1,400 Microsoft External Staff Moderator

Hello Kaushik Ray,

Thank you for posting your query on Microsoft Q&A.

We understand that you have Jenkins pipeline where users authenticate with keycloak and the pipeline gets access token and you configured App Registration in Azure AD and federated secret with issuer, subject and audience to establish trust with keycloak and it works for users where you have added their subjects in federated secrets.

If you want to deploy resources in Azure, you can add Keycloak as External Identity to authenticate with Keycloak.

Handling the number of users by adding a user subject in the access token is not suggestible.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Venkata Jagadeep 1,400 Reputation points Microsoft External Staff Moderator

2025-02-12T18:32:25.2733333+00:00

Hello Kaushik Ray,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Kaushik Ray 5 Reputation points

2025-02-13T16:20:14.57+00:00

Hello @Venkata Jagadeep ,

I understand managing individual users and adding their subject as federated secrets is not feasible, however what could be possible solution in such a case where users authenticate themselves in Keycloak and based on that would like to trigger build and deployment on Azure cloud. What are suggested options with which users can authentiate in Keycloak and use this token for federated identity.
Venkata Jagadeep 1,400 Reputation points Microsoft External Staff Moderator

2025-02-14T01:31:43.2266667+00:00

Hello Kaushik Ray,

We suggest integrating Keycloak as an external identity provider in Azure, allowing users to authenticate through Keycloak and leverage the obtained token to access Azure resources.
Venkata Jagadeep 1,400 Reputation points Microsoft External Staff Moderator

2025-02-17T20:55:16.9233333+00:00

Hello Kaushik Ray,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Share via

Establishing Federated Trust between Keycloak and Azure AD for Pipeline Deployments with Multiple Users

1 answer

Your answer