---
title: Integrating SAML SSO with Keycloak IdP for Your Application
slug: contact-center/integrating-saml-sso-with-keycloak-idp-for-your-application
docTags: 
createdAt: 2025-10-14T09:27:05.847Z
---

This document provides comprehensive guidance on integrating SAML Single Sign-On (SSO) with Keycloak Identity Provider (IdP) for your application. Since your system is already a SAML client integrated with various IdPs like ADFS and OKTA, no code or design changes are expected.

- Support SAML authentication via Keycloak IdP.
- Leverage existing SAML client capabilities without additional code changes.

## 1. Keycloak Configuration Steps

## 1.1 Install Keycloak

- Download Keycloak from the official archive: **Getting Started Zip**.
- Follow installation instructions tailored for your environment: **Server Administration Guide**.

## 1.2 Create a SAML Client (SSO Application) in Keycloak

- Log into the Keycloak Admin Console.
- Navigate to **Clients** and click **Create**.
- Set the **Client ID** as your application’s SAML service provider identifier.
- Choose **SAML** as the client protocol.
- Configure the **Assertion Consumer Service (ACS) URL** to point to your application server’s SAML endpoint.
- Configure other settings such as **Name ID Format**, **Signature Algorithm**, and **Valid Redirect URIs** according to your application’s requirements.
- Download the **IdP Metadata XML** from Keycloak for use in your application server configuration.

## 1.3 Optional: Define User Attributes

- Map user attributes and roles to be sent in SAML assertions as needed.

## 2. Application Server Configuration Steps

- Use your application’s existing SAML client configuration mechanism.
- Replace or add a new SAML connection using the Keycloak IdP metadata.
- Update the following as per Keycloak’s metadata:
  - Entity ID
  - SSO URL
  - X.509 Certificate
  - Attribute mappings
- Restart the application server to apply changes.

## 3. Verification and Testing

- Initiate login flow through your application.
- Confirm users are redirected to Keycloak for authentication.
- Verify the SAML response and successful login into your application.

## 4. Additional Resources (Internal)

- **Configure SAML SSO with OKTA:  [https://oldsites.ameyo.net/view/engineering/configure-saml-sso-via-okta.html](https://oldsites.ameyo.net/view/engineering/configure-saml-sso-via-okta.html)**
- **Configure SAML SSO with Any IdP: **
**[https://oldsites.ameyo.net/view/engineering/configure-saml-sso-via-any-idp.html](https://oldsites.ameyo.net/view/engineering/configure-saml-sso-via-any-idp.html)**
- **Keycloak Official Documentation – Server Admin: **
**[https://www.keycloak.org/getting-started/getting-started-zip](https://www.keycloak.org/getting-started/getting-started-zip)**
  **[https://www.keycloak.org/docs/latest/server\_admin/](https://www.keycloak.org/docs/latest/server_admin/)**

## Version History

| Version | Enhancement                                                             | Release Notes                                         |
| ------- | ----------------------------------------------------------------------- | ----------------------------------------------------- |
| 4.13.27 | Keycloak validated as a SAML IdP — no application code changes required | [4.13.27 Release Notes](docId\:Dd0Ux5qi9BtdJYtL4NU7m) |