> ## Documentation Index > Fetch the complete documentation index at: https://wundergraphinc-ahmet-eng-8587-documentation-for-connect-cli.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Keycloak > Setting up SSO with Keycloak ### Steps to set Keyclaok as an OIDC identity provider Navigate to the **Clients** view within your Keyclaok Dashboard. Click on **Create Client**. Select OpenID Connect as the **Client Type, and** give the client a **Client ID**and a **Name**and then click on **Next.** Enable **Client authentication,** then click on **Next** and then click on **Save**on the next page**.** Navigate to the **Credentials** tab and then copy the **Client Secret.** Navigate to the **Realm Settings** and then copy the link of **OpenID Endpoint Configuration.** Navigate to the settings page on Cosmo. Click on **Connect.** Give the connection a name, paste the **OpenID Endpoint Configuration** copied before, into the **Discovery Endpoint,**and paste the **Client ID** and **Client secret**copied before into the **Client ID** and **Client Secret fields respectively,**and then click on **Connect.** Configure the mapping between the roles in Cosmo and the user groups in Keycloak. The field **Group in the provider** can be populated with the name of the group or a regex to match the user groups. Once all the mappers are configured, click on **Save**. Copy the sign-in and sign-out redirect URIs displayed in the dialog. Navigate back to the client created on Keycloak and populate the **Valid redirect URIs** and **Valid post Logout redirect URIs** with the above-copied sign-in and sign-out URLs respectively. Click on **Save**. Navigate to the **Client Scopes** tab, click on the first client scope(usually would be \$\{**clientID}-dedicated**), and then click on **Configure a new mapper.** Select **Group Membership.** Give the mapper a name, then populate the **Token Claim Name** with **"**ssoGroups**"** and then click on **Save.** Now you can assign users/groups to the application, and those users will be able to log into Cosmo using the URL provided on setting up the provider.