Implement Keycloak MFA with PPM Center

Available from version 26.3: This section provides information on how to implement Keycloak-based multi-factor authentication (MFA) with OpenText PPM.

Setting up Keycloak MFA with PPM

  1. Prepare Keycloak and OpenText PPM environment:

    • Make sure Keycloak and OpenText PPM are reachable from each other.
    • Use a Keycloak administrator account.
  2. Create or select a realm for OpenText PPM users.
  3. Create an OpenID Connect client for OpenText PPM.

  4. In the client configuration, set the following:

    Redirect URI: <PPM_BASE_URL>/itg/mfa-callback

    Client authentication method: client ID and secret

  5. Save the client, and copy the client ID and client secret for later configuration in OpenText PPM.
  6. In authentication flows, ensure OTP is required for the browser login flow used by this realm.
  7. To localize Keycloak login and OTP pages, enable localization in realm settings, add the required supported locales, and set the default locale.

Configure MFA in PPM Center

  1. Edit the PPM server.conf file as follows:

    com.kintana.core.server.MFA_KEYCLOAK_ENABLED=true

    com.kintana.core.server.MFA_KEYCLOAK_ISSUER_URL=<keycloak_realm_issuer_url>

    com.kintana.core.server.MFA_KEYCLOAK_CLIENT_ID=<keycloak_client_id>

    com.kintana.core.server.MFA_KEYCLOAK_CLIENT_SECRET=<keycloak_client_secret>

    com.kintana.core.server.MFA_KEYCLOAK_REDIRECT_URI=<PPM_BASE_URL>/itg/mfa-callback

  2. Save the file and restart OpenText PPM user instances.

Login flow and OTP behavior

  1. Users sign in with their OpenText PPM credentials.
  2. After primary authentication, users are redirected to Keycloak for OTP validation.
  3. After OTP succeeds, Keycloak redirects users back to OpenText PPM through the MFA callback URL and login is completed.
  4. When OTP is not configured for a user, Keycloak prompts the user to register OTP first, and then enforces OTP during subsequent sign-ins.

Troubleshooting

  • To troubleshoot MFA login, check the <ppm_server>/log/serverLog.txt file.
  • If users cannot complete OTP after a device change, reset the user OTP credential in Keycloak and require OTP reconfiguration for that user.
  • Verify the redirect URI in the Keycloak client exactly matches the MFA_KEYCLOAK_REDIRECT_URI value in server.conf.