# Does Keycloak meet my requirements? (Social oauth, email auth, SSO multi domain) **URL:** \ **Category:** Getting advice\ **Tags:** authentication\ **Created:** [January 19, 2023, 12:54am UTC](https://forum.keycloak.org/t/does-keycloak-meet-my-requirements-social-oauth-email-auth-sso-multi-domain/19713 "2023-01-19T00:54:17Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![marcoBros](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@marcoBros](https://forum.keycloak.org/u/marcoBros)\ **Post date:** [January 19, 2023, 12:54am UTC](https://forum.keycloak.org/t/does-keycloak-meet-my-requirements-social-oauth-email-auth-sso-multi-domain/19713/1 "2023-01-19T00:54:17Z")
Hello everyone, I know how authentication systems work overall. However, it gets really complex for me when I want to integrate single sign-on for my different apps from different domains, including social login and email login. So I come to you to clear my mind, to find out if my following expectations can be met with keycloak , and to get the right documentation place to get head šŸ™‚ In detail, I have my paradise would have these features: - User can login with oauth social (google, apple, twitter, ā€¦) - User can login with email address - User just need to login once and get access to all different apps on different domains (websites, mobile app, app, ā€¦) - Send emails (greeting, password recovery and others related to authentication) with a dedicated template for each application. - Define user roles dedicated to the application or for all applications - Provide private API access via API key and API secret (HMAC authentication) for some domaine - Add two-factor authentication for certain accesses. I donā€™t believe in Santa Claus except when Iā€™m good, so Iā€™m fine if some of my prerogatives arenā€™t satisfactory. And is it complex to setup all that features ? Am I gonna pass the rest of the year trying to setup it ? Thank you so much šŸ™‚ ---
**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\ **Post date:** [January 19, 2023, 8:19am UTC](https://forum.keycloak.org/t/does-keycloak-meet-my-requirements-social-oauth-email-auth-sso-multi-domain/19713/2 "2023-01-19T08:19:20Z")
Well, ho ho ho, I think today just might be Christmas for you. All of the items provided on your list are available in Keycloak except ā€œProvide private API accessā€¦ā€ In general, the things you have listed are pretty easy to configure. Documentation for most of it can be found in these two places: [https://www.keycloak.org/docs/latest/securing\_apps/index.html](https://www.keycloak.org/docs/latest/securing_apps/index.html) [https://www.keycloak.org/docs/latest/server\_admin/index.html](https://www.keycloak.org/docs/latest/server_admin/index.html) This forum is a good place to get answers to configuration questions. Try it yourself, post some detail on whatā€™s going wrong, and youā€™ll likely get a helpful answer here. Regarding the ā€œProvide private API accessā€¦ā€ feature, can you elaborate a bit? Keycloak has an extensive admin API, but the authentication isnā€™t ā€œvia API key and API secret (HMAC authentication)ā€ but via client ID and secret. Documentation on that API is here: [https://www.keycloak.org/docs-api/20.0.3/rest-api/index.html](https://www.keycloak.org/docs-api/20.0.3/rest-api/index.html) ---
**Author:** ![marcoBros](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@marcoBros](https://forum.keycloak.org/u/marcoBros)\ **Post date:** [January 22, 2023, 2:44pm UTC](https://forum.keycloak.org/t/does-keycloak-meet-my-requirements-social-oauth-email-auth-sso-multi-domain/19713/3 "2023-01-22T14:44:09Z")
Wow, Iā€™m really enthusiastic about keycloak. Indeed, I did some tests with the docker container and configured a nodejs js server to serve static html/js files and an public/private API access. Currently the client browser authenticates itslef directly to the keycloak server and it works like a charm =\> Keycloak looks neat! šŸ˜ƒ However, Iā€™m a bit confiuse about auth flow and configuration for my different clients and this is also related to the ā€œprivate API accessā€ I was talking about. Let me explainā€¦ - Keycloak server is running under the sub domaine _auth.domain.a_. - The nodejs servers js static files and API from _domain.a_. - Js scripts from client browser talk directly with _auth.domain.a_ to log user in via keycloak.js (Email and Identity provider auth) by using OpenId connect protocol and need to perform some requests to restricted API endpoint to _domain.a_ - Some client backend API, that I dont know which technology they using and itā€™s not an issue, must perform some requests to restricted API as well to _domain.a_. - Some websites from _domain.x_ must request some auth to _auth.domain.a_ to be logged in to \*_.domain.x_ and \*_.domain.a_ (SSO) but this is not the subject for today šŸ™‚ Two things here (client browsers and external client backend API): First, Iā€™m trying to figure out how nodejs server running under _domain.a_ could verify if the _client browser_ is logged in to _auth.domain.a_ to restrict access to some API endpoints at _domain.a_, and here are the questions that come to mind: - What authentication data should the client browser provide to the nodejs API server (JWT access token?). - Should nodejs talk to keycloak via keycloak admin API to verify access token? - Does nodejs act as a registered client for keycloak? - What authentication protocol should I configure for keycloakā€™s nodejs client to elucidate this use case in general? And to finish, - Which auth protocol should I use to restrict nodejs API endpoint from _domain.a_, not for client browser this time but for _external client API_ ? I think the common way to secure API itā€™s to provide them an API key and API secret, but which auth protocol should be underneath? Itā€™s quite a lot of question šŸ˜› and itā€™s showing my knot bag thatā€™s in my head when thinking about auth šŸ˜