> ## Documentation Index > Fetch the complete documentation index at: https://wundergraphinc-brendan-add-sof-link.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Keycloak > Setting up SSO with Keycloak ### Steps to set Keyclaok as an OIDC identity provider Navigate to the **Clients** view within your Keyclaok Dashboard. Click on **Create Client**. Select OpenID Connect as the **Client Type, and** give the client a **Client ID**and a **Name**and then click on **Next.** Create client form for OpenID Connect with general, capability, and login settings Enable **Client authentication,** then click on **Next** and then click on **Save**on the next page**.** Create client page in Cosmo Docs with client authentication on and authorization off Navigate to the **Credentials** tab and then copy the **Client Secret.** Client Authenticator settings showing client ID, secret, and regenerate option Navigate to the **Realm Settings** and then copy the link of **OpenID Endpoint Configuration.** OpenID and SAML metadata settings with user-managed access turned off Navigate to the settings page on Cosmo. Click on **Connect.** Organization settings showing name, slug, and status of AI, RBAC, and SCIM features Give the connection a name, paste the **OpenID Endpoint Configuration** copied before, into the **Discovery Endpoint,**and paste the **Client ID** and **Client secret**copied before into the **Client ID** and **Client Secret fields respectively,** and then click on **Connect.** Connect OpenID Connect Provider form with fields for name, endpoint, and credentials Configure the mapping between the roles in Cosmo and the user groups in Keycloak. The field **Group in the provider** can be populated with the name of the group or a regex to match the user groups. Once all the mappers are configured, click on **Save**. Group mapper configuration dialog linking provider groups to Cosmo roles Copy the sign-in and sign-out redirect URIs displayed in the dialog. Steps to configure OIDC provider with sign-in and sign-out redirect URLs Navigate back to the client created on Keycloak and populate the **Valid redirect URIs** and **Valid post Logout redirect URIs** with the above-copied sign-in and sign-out URLs respectively. Click on **Save**. Access settings showing valid redirect and logout URLs fields Navigate to the **Client Scopes** tab, click on the first client scope(usually would be \$\{**clientID}-dedicated**), and then click on **Configure a new mapper.** Client scope page showing dedicated mappers section with no mappers added Select **Group Membership.** Configure new mapper dialog with Group Membership option for token mapping Give the mapper a name, then populate the **Token Claim Name** with **"**ssoGroups**"** and then click on **Save.** Now you can assign users/groups to the application, and those users will be able to log into Cosmo using the URL provided on setting up the provider.