OpenProject v9.03 on Debian 9 works great using OpenID with Keycloak Server. After upgrade to OpenProject 10.0 OpenID doesn't work anymore with the configuration below.

Instead of redirecting a user without valid ticket to https://auth.mserver.org/auth/realms/master/protocol/openid-connect/auth?client_id=OpenProjectMartin&nonce=762d9653255d825d59f8a9cd66e1953b&redirect_uri=https%3A%2F%2Fopenproject.heiliger-martin-kaiserslautern.de%2Fauth%2Fkeycloak%2Fcallback&response_type=code&scope=openid+email+profile&state=8f713708462dcdde48b8b6c471297cea

user is directed to https://openproject.hserver.de/auth/keycloak with error message: Fehler: Datei nicht gefunden      Beim Verbinden mit openproject.hserver.de trat ein Fehler auf.

The working configuration (till v. 9.0.3) in file /opt/openproject/config/configuration.yml below default:

 openid_connect:

   keycloak:

     sso: true

     host: "auth.mserver.org"

     identifier: "OpenProjectMartin"

     secret: "e333-333-333-33333-3333-3333b"

     icon: "openid_connect/auth_provider-google.png"

     display_name: "KeyCloak Authorisation"

     authorization_endpoint: "https://auth.mserver.org/auth/realms/master/protocol/openid-connect/auth"

     token_endpoint: 'https://auth.mserver.org/auth/realms/master/protocol/openid-connect/token'

     userinfo_endpoint: 'https://auth.mserver.org/auth/realms/master/protocol/openid-connect/userinfo'

     end_session_endpoint: 'https://auth.mserver.org/auth/realms/master/protocol/openid-connect/logout'

     check_session_iframe: 'https://auth.mserver.org/auth/realms/master/protocol/openid-connect/login-status-iframe.html'

     issuer: 'https://openproject.hserver.de/login'

     discovery: false

 disable_password_login: true

 omniauth_direct_login_provider: keycloak

Regards

Andreas

Hi Andreas,

this is the same issue was in https://community.openproject.com/topics/11243?r=11272#message-11272 SSO Authentication was an Enterprise Edition feature that was not technically blocked in older versions and this has been corrected in 10.0.

I'll reach out to you how we can resolve the immediate issue at hand.

Best,

Oliver