User-migration.md

@@ -69,17 +69,51 @@ $databases['migrate']['default'] = array(
 ```plaintext
 drush migrate-manifest manifest.yml
 ```
+
 ### Enable Basic Auth & Rest
-```
+
+```plaintext
 drush en rest restui basic_auth
 ```
-...and enable REST for _file upload_ by going to the url: 
-[/admin/config/services/rest/resource/file:upload/edit](url)
 
-providing *POST* permissions with _basic_auth_ and _cookie_
+...and enable REST for _file upload_ by going to the url: [/admin/config/services/rest/resource/file:upload/edit](url)
+
+providing _POST_ permissions with _basic_auth_ and _cookie_
 
 [/admin/config/services/rest/resource/entity:user/edit](url)
 
-Providing *PATCH* permissions with _basic_auth_ and _cookie_
+Providing _PATCH_ permissions with _basic_auth_ and _cookie_
+
+### Enable SSO with identitats.guifi.net (keycloak/OpenID)
+
+Install the modules:
+
+`composer require drupal/keycloak drupal/openid_connect`
+
+`drush en keycloak openid_connect -y`
+
+### Configure SSO
+
+#### At identitats.guifi.net (keycloak)
+
+Setup de redirect URI for the openid-connect Client:
+
+`http://<my_host>/net/openid-connect/keycloak`
+
+#### At the drupal site:
+
+Go to the configuration for OpenID-Connect:\
+<https://network.guifi.net/admin/config/services/openid-connect>
+
+- _Enable_ **keycloak** / **identitats.guifi.net**
+- Specify the **Client ID** & **Secret**
+- **Keycloak base URL** to <https://identitats.guifi.net/auth>
+- **Keycloak Realm** to _master_
+- _Enable_ **Update email address in user profile**
+- **Enable user role mapping** set to _true_
+- **Override registration settings** set to _true_
+- **Save user claims on every login** set to _true_
+- **OpenID buttons display in user login form** set to _Replace_
+- **Automatically connect existing users** set to _true_
 
 eof
\ No newline at end of file