# Keycloak Use these instructions to set up Keycloak as your SSO provider for Tonic Structural. ## Keycloak configuration ### Create the client Within Keycloak**,** select the realm to use for your Structural client. Under **Clients**, click **Create client**.

On the **Create client** page, under **General Settings**: 1. From the **Client type** dropdown list, select **OpenID Connect**. 2. Enter a **Client ID** and **Name**. 3. Click **Next**.

Create client fields for a Keycloak client

4. On the **Capability Config** tab, click **Save**. The details page for the new client displays. ### Configure Structural URLs On the **Settings** tab, under **Access settings**, enter your Structural URL information.

### Configure the dedicated scope Click **Client scopes**. Each client has a dedicated scope named `-dedicated`. To configure the scope, click the scope name.

### Add a group membership property mapper On the **Mappers** tab, to add a property mapper to the scope, click **Configure a new mapper**.

Options to add a property mapper to a Keycloak client scope

In the list of mapper types, click **Group Membership**.

Available mapper types for a Keycloak client scope property mapper

Under **Add mapper**, set both **Name** and **Token Claim Name** to `groups`.

Configuration options for a Keycloak property mapper

The **Full group path** toggle affects how child groups appear in Tonic: * When on, child groups display as `parent group/child group`. * When off, child groups display as `child group`. To save the new group membership mapper, click **Save**. ## Structural configuration In the Structural web server container, set the following [Structural environment settings](/app/admin/environment-variables-setting.md) : * `TONIC_SSO_PROVIDER`: `Keycloak` * `TONIC_SSO_DOMAIN`: `https://my-keycloak-instance` * `TONIC_SSO_CLIENT_ID`: \ * `TONIC_SSO_REALM_ID`: \ * `TONIC_SSO_GROUP_FILTER_REGEX:` Identifies the allowed SSO groups for Structural. For details, go to [Synchronizing SSO groups with Structural](/app/admin/tonic-user-access/single-sign-on/sso-limit-groups.md). --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.tonic.ai/app/admin/tonic-user-access/single-sign-on/keycloak.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.