Verified Ham with Keycloak
Add Verified Ham as an identity provider in Keycloak, for every app behind it.
If your apps already sign in through Keycloak, add Verified Ham as an identity provider once and every app behind Keycloak can offer it. Keycloak handles the protocol; your apps see the call sign as a user attribute.
1. Register your app
- Create a Verified Ham account, if you don't have one, and sign in.
- Go to Register an app.
- Give it a name. People see it when they sign in.
- Set the redirect URI to:
https://keycloak.example.com/realms/myrealm/broker/verifiedham/endpoint - Choose Confidential, and register.
- Copy the client ID and client secret. The secret is shown only once.
You can sign in to your own app straight away, to test. Other people can sign in once you've verified your own call sign.
Use your Keycloak address and realm in place of keycloak.example.com and myrealm. The last-but-one segment is the alias you'll give the provider below.
2. Add the identity provider
In the Keycloak admin console, open your realm, go to Identity providers, and add an OpenID Connect v1.0 provider:
| Field | Value |
|---|---|
| Alias | verifiedham |
| Display name | Verified Ham |
| Discovery endpoint | https://verifiedham.net/.well-known/openid-configuration |
| Client authentication | Client secret sent as basic auth |
| Client ID / Client Secret | from step 1 |
| Use PKCE | on, with method S256. Verified Ham requires it. |
| Scopes | openid callsign email |
3. Map the call sign
On the provider's Mappers tab, add an Attribute Importer mapper
with claim callsign and user attribute name callsign, and another for
callsign_verified. Then add them to your clients' tokens with a user attribute mapper on
a client scope, as with any Keycloak attribute.
Only verified operators can sign in to your app, except you while you test before verifying yourself; check callsign_verified anyway, as it's false in that case.