Configuring OIDC with PKCE in Keycloak for VCF Private AI Services

I have taken a short hiatus from playing with my NVIDIA RTX 4000, which fits perfectly inside a Minisforum MS-A2 and is what I use to run VMware Cloud Foundation (VCF) 9.1. While redeploying my environment to test an upcoming release of VCF Private AI Services (PAIS), I was reminded that the deployment requires an OIDC provider that supports the Authorization Code grant flow with PKCE (Proof Key for Code Exchange).

When I originally deployed PAIS with VCF 9.0, I used Authentik as my identity provider (IdP). With my VCF Infrastructure Services (VIS) Appliance which provides a number of services including Keycloak as an OIDC provider, I wanted to figure out the required Keycloak configuration to satisfy the PAIS OIDC requirements, especially as this can help accelerate Lab/PoC deployments.

After some trial and error, and with the help of OpenAI Codex to debug my live environment, I now have Keycloak successfully configured with PAIS, along with a script to generate the access token required to interact with a PAIS Model Endpoint! 🥳

Step 1 - Log in to the Keycloak Admin UI and switch to the desired realm by navigating to Manage realms.

Step 2 - From the left-hand navigation, select Clients and create a new OIDC client. Provide a Client ID and Name, and optionally enable Always display in UI.

Under Authentication Flow, enable both Standard flow and Direct access grants, with the latter being useful for debugging purposes. Set the PKCE Method to S256.

Set the Valid Redirect URL to the FQDN that you will/have assigned to your PAIS Service configuration (e.g. pais.vcf.lab) and ensure that it includes a trailing slash (e.g. https://pais.vcf.lab/). Add the same FQDN to Web Origins, but without the trailing slash (e.g. https://pais.vcf.lab).

Step 3 - Select the OIDC client that you just created and navigate to the Client Scopes tab. You should see a default dedicated client scope named <name>-dedicated. Select the dedicated client scope, where we will add two mappings, one for groups and another for audience.

Click Add Mapper by Configuration and select Group Membership. Provide a Name, set Token Claim Name to groups, and disable Full group path.

Click Add Mapper by Configuration and select Audience. Provide a Name, select the OIDC client that you created in Step 1 for Included Client Audience, and enable Add to access token.

Step 4 - From the left-hand navigation, select Groups to create your desired group and add users to the group by navigating to Users. For this example, I will assume you have created a group called vcf-admins for demonstration purposes.

At this point, you have successfully created the required OIDC Client with PCKE and this would translate to the following when configuring the IdP for PAIS

auth:
  providers:
  - name: oidc
    oidc:
      authorizedGroups:
      - vcf-admins
      clientId: pais
      groupsClaim: groups
      issuerUrl: https://vis.vcf.lab:9444/realms/VCF
      scope:
      - openid
      - profile
      - offline_access

Note: The issuerUrl can be obtained from Keycloak Admin UI under Realm settings and hover over the OpenID Endpoint Configuration link at the bottom of the page and remove everything after the /.well-known/* string

After successfully deploying a Model Endpoint, you will be provided with an OpenAPI endpoint that you can use to send queries to your deployed AI model. Before connecting to the endpoint, you will need to provide an API key obtained from your IdP, which in our case is Keycloak.

curl -k https://pais.vcf.lab/api/v1/compatibility/openai/v1/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $PAIS_API_KEY" \
  -d '{
        "model": "gpt-oss-20b",
        "prompt": "What is the capital of the United States?",
        "max_tokens": 200,
        "temperature": 0
      }'

Unfortunately, Keycloak does not provide a graphical interface for generating an API token. With help from Google Gemini, I had it create a shell script called validate_keycloak_pkce_api_token_for_pais.sh that performs the PKCE authorization flow to retrieve an authorization code and exchange it for a valid access token that can be used with a PAIS Model Endpoint.

You will need to update the variables at the top of the script with your specific configuration:

KEYCLOAK_HOST="https://vis.vcf.lab:9444"
REALM="VCF"
CLIENT_ID="pais"
REDIRECT_URI="https://pais.vcf.lab/"
SCOPES="openid profile email"

Run the shell script, which will generate an authorization URL that you can open in a new web browser to begin the authentication flow.

You should be redirected to your IdP, where you will log in with a valid user that belongs to the IdP group you configured in Step 4.

Once authenticated, copy the URL from your browser and paste it back into the shell script, which will exchange the authorization code for an access token that can then be used to authenticate with your PAIS Model Endpoint.

Copy the access_token and set it as the PAIS_API_TOKEN environment variable. You should now be able to successfully connect to your PAIS Model Endpoint and retrieve a response from your deployed AI model.

Thanks for the comment!Cancel reply