Integrating SAML SSO with Keycloak IdP for Your Application
5 min
This document provides comprehensive guidance on integrating SAML Single Sign-On (SSO) with Keycloak Identity Provider (IdP) for your application. Since your system is already a SAML client integrated with various IdPs like ADFS and OKTA, no code or design changes are expected.
- Support SAML authentication via Keycloak IdP.
- Leverage existing SAML client capabilities without additional code changes.
1. Keycloak Configuration Steps
1.1 Install Keycloak
- Download Keycloak from the official archive: Getting Started Zip.
- Follow installation instructions tailored for your environment: Server Administration Guide.
1.2 Create a SAML Client (SSO Application) in Keycloak
- Log into the Keycloak Admin Console.
- Navigate to Clients and click Create.
- Set the Client ID as your application’s SAML service provider identifier.
- Choose SAML as the client protocol.
- Configure the Assertion Consumer Service (ACS) URL to point to your application server’s SAML endpoint.
- Configure other settings such as Name ID Format, Signature Algorithm, and Valid Redirect URIs according to your application’s requirements.
- Download the IdP Metadata XML from Keycloak for use in your application server configuration.
1.3 Optional: Define User Attributes
- Map user attributes and roles to be sent in SAML assertions as needed.
2. Application Server Configuration Steps
- Use your application’s existing SAML client configuration mechanism.
- Replace or add a new SAML connection using the Keycloak IdP metadata.
- Update the following as per Keycloak’s metadata:
- Entity ID
- SSO URL
- X.509 Certificate
- Attribute mappings
- Restart the application server to apply changes.
3. Verification and Testing
- Initiate login flow through your application.
- Confirm users are redirected to Keycloak for authentication.
- Verify the SAML response and successful login into your application.
4. Additional Resources (Internal)
- Configure SAML SSO with OKTA: https://oldsites.ameyo.net/view/engineering/configure-saml-sso-via-okta.html
- Configure SAML SSO with Any IdP: https://oldsites.ameyo.net/view/engineering/configure-saml-sso-via-any-idp.html
- Keycloak Official Documentation – Server Admin: https://www.keycloak.org/getting-started/getting-started-zip https://www.keycloak.org/docs/latest/server_admin/
Version History
Have a question?
Our knowledgeable support team and an awesome community will get you an answer in a flash.
To ask a question or participate in discussions, you'll need to authenticate first.