# Using Keycloak as an identity provider with Pomerium

**URL:** <https://discuss.pomerium.com/t/using-keycloak-as-an-identity-provider-with-pomerium/52>\
**Category:** Support\
**Tags:** idp\
**Created:** [December 27, 2021, 7:26pm UTC](https://discuss.pomerium.com/t/using-keycloak-as-an-identity-provider-with-pomerium/52 "2021-12-27T19:26:43Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![bobby](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/bobby/32/1_2.png) [@bobby](https://discuss.pomerium.com/u/bobby)\
**Post date:** [December 27, 2021, 7:26pm UTC](https://discuss.pomerium.com/t/using-keycloak-as-an-identity-provider-with-pomerium/52/1 "2021-12-27T19:26:43Z")

</div>

[**View in #support on Slack**](https://slack.com/archives/CK92MUAES/p1640547752092300)

![Jay](https://secure.gravatar.com/avatar/1f8d4590f39859e88677454a03e7e022.jpg?s=24&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0021-24.png) **@Jay:** Hey, I’m trying to use Pomerium with Keyclock OIDC as the IDP but I’m getting this error whenever a user authenticates. I’ve tried searching but I can’t find anyone else who has solved this issue in the past so was wondering if you guys had any pointers for me.

Thanks in advance 🙂

![Bobby](https://avatars.slack-edge.com/2020-04-13/1082582365824_b02c221d94bd1c0fd6ad_24.jpg) **@Bobby:** Hey Jay, thanks for reaching out. It looks like your surf provider (key cloak) is not responding with the id\_token that’s required for open id connect based flows which pomerium relies on. I’m not very familiar with keycloak but I imagine it’s configuration there.

![Jay](https://secure.gravatar.com/avatar/1f8d4590f39859e88677454a03e7e022.jpg?s=24&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0021-24.png) **@Jay:** Hey Bobby, thanks for taking a look. Will reach out to them. Have a good holiday!  
Fixed it - needed to add the `openid` scope in the Pomerium config, I only had the `email` scope