Keycloak SAML SSO (SP & IdP Integration)

How to integrate a Keycloak SP with another Keycloak IdP via SAML protocol. This setup supports Single Sign On (SSO) & Single Log Out (SLO).
Shows how to use Keycloak as both an identity provider (IdP) and a service provider (SP)

[@vil9386]

Aha... Awesome info. Thanks for this short and very neat tutorial on how SAML works.

[@ankurarora5093]

Very nice video. Thank you!

[@mchorvat]

great video. very good explanation of SAML setup between two Keycloaks. Thank you very much!

[@Rambou92]

Apart from the "Indian accent" this was an awesome tutorial to quickly craft and set up a playground and make tests on SP and IdP for SAML 2.0. Bravo!!

[@genericnep]

Great place to start to learn about IDP. Can you please do a similar one using OIDC?

[@Nexode_]

Thank you so much

[@user-uq7hg9zw5j]

Really nice tutorial. Is this procedure suitable to integrerate external IDP?

[@jeremysweetman6532]

Is there a video on using a SAML parameter in the authentication flow? like, I want to get a parameter from the client in the initial saml request, and use that in the auth flow to resolve passing/failing the authentication flow. (i have a custom provider in my current flow doing that, but instead of using something from a SAML request, it's using the username resolved from the previous username form execution step.)

[@shishirroy1516]

excellent video. can you create an individual session for SP init & Idp init flow using keycloak.

[@hexadefence]

Thank you very much. Will create a video on SP and IDP initiated flows.

[@shishirroy1516]

@@hexadefence thanks a lot

[@diptochandra]

Can you please help me to establish connection between aws managed grafana and keycloak with SAML.

[@igorlfc]

Hi and thx for your tutorial. I have a question to min 5:19 can you pass Email, First name and Last name from IDP on localhost:9090 to your target IPD Hexadefence on localhost:8080? Simply said just import user hexa in your IDP on localhost:8080

[@oculosme]

Hi! This was super interesting, thanks a lot! Could you give some examples on how to map the other attributes? I didn't get to make it automatically import the username, First Name, etc. Thanks a lot!

[@hexadefence]

Thanks for the reply. You can use mappers section in identity provider configurations to map other attributes.

[@oculosme]

@@hexadefence thank you! I tried that, but still the fields were empty. :(

[@nareshreddygondewar3885]

i am unable to find the realm-managment role and realm-admin roles please suggest best way

[@vasudev1918]

Hi, can you make a video on how to integrate saml SSO for our react application with keycloak

[@sauarbhdiwan]

how to change endpoint in saml I get we are sorry message after authentication

[@user-im2uy1cc9m]

@hexaDefence How can we use keycloak IDP instance to do IDP initiated login into SP keycloak instance

[@ParamanandaMishra]

How to auto redirect to idp login page instead of sp. Once key in credentials at idp without uaer registration page how to redirect to application

[@keycloakuser4716]

@hexaDefence Did you get the IDP initiated workflow to work? SP init workflow works but not IDP init

[@hexadefence]

It is possible with SAML. Not sure with OpenID Connect.

[@keycloakuser4716]

@@hexadefence Can you kindly post a demo video showing the IDP initiated workflow? Thanks

[@hexadefence]

Sure

[@surajhk31]

@@hexadefence Can we create 2 clients in keycloak - one is SAML and another is OpenID and just one app in Okta..And still be able to do both SP initiated and IdP initiated login ?

[@hexadefence]

It should be possible as per my understanding on your requirement.

[@daxeshshukla7131]

How to run multiple instance on docker

[@NaveenKumar-gr5te]

Hi, can you help me get the Access Token for IT (Integration Test) with Okta as IDP.

[@hexadefence]

Thanks for the question Is this problem already sorted?

[@NaveenKumar-gr5te]

@@hexadefence not yet

[@ismailrehman7434]

can you share the integration with Laravel 8?

[@sachinthaashok1302]

I want to use spring security application with login functionality. From that app, I want to provide a link to access Keycloak apps via SAML. Is that possible?

[@hexadefence]

Thanks for the question. I think you are referring to sp initiated sso with SAML. This is possible

[@daxeshshukla7131]

make a video on how to run two keycloak instance with docker

[@hexadefence]

You can easily do that by either using a docker compose file or using docker run command twice with two External ports of the host machine

[@sanjeetcoder3063]

Brother can u please let me know, how did u configure two different ports, I got stuck here

[@sanjeetcoder3063]

Please explain in detail, thanks

[@hexadefence]

Thanks for the question. I am using docker containers to run multiple instances of keycloak.

[@sanjeetcoder3063]

@@hexadefence thanks ,

[@sanjeetcoder3063]

I am using keycloak with Saml and trying to access SAML assertion in front-end but getting error, but it's working well with open-id, is there any idea?

[@shashilakshan2883]

Hi, can you please do video on keycloak docker integrate with external mysql server

[@hexadefence]

Hi Lakshan, Thanks for your suggestion. Did you try the steps provided here (hub.docker.com/r/jboss/keycloak/) about connecting an external DB with keycloak docker.

[@shashilakshan2883]

@@hexadefence I tried with sudo docker run -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin -p 8080:8080 -e DB_VENDOR=MYSQL -e DB_ADDR=127.0.0.1 -e DB_PORT=3306 -e DB_DATABASE=keycloak -e DB_USER=keycloak -e DB_PASSWORD=keycloak jboss/keycloak But I am getting, below error ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("subsystem" => "metrics")]): java.lang.NullPointerException at [e-mail]//org.wildfly.extension.metrics.MetricsSubsystemAdd$2.execute(MetricsSubsystemAdd.java:91) at [e-mail]//org.jboss.as.controller.AbstractOperationContext.executeStep(AbstractOperationContext.java:1040) at [e-mail]//org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:779) at [e-mail]//org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:468) at [e-mail]//org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1415) at [e-mail]//org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:529) at [e-mail]//org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:515) at [e-mail]//org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:477) at [e-mail]//org.jboss.as.server.ServerService.boot(ServerService.java:459) at [e-mail]//org.jboss.as.server.ServerService.boot(ServerService.java:412) at [e-mail]//org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:416) at java.base/java.lang.Thread.run(Thread.java:829) 11:36:24,999 ERROR [org.jboss.as.server] (ServerService Thread Pool -- 46) WFLYSRV0022: Deploy of deployment "keycloak-server.war" was rolled back with no failure message

[@JohnSinha-eh2ov]

sir please explain the idp initiated sso btw two keycloack servers unable to find it in internet please sir you are the last hope

[@hexadefence]

When you setup a saml client in keycloak. It exposes a url for idp initiated logins. Please create a saml client in keycloak, then you will be able to get that link from saml client settings

[@JohnSinha-eh2ov]

@@hexadefence sir can you see this out put i have provided the link, i want same output btw two keycloack servers . kzbin.info/www/bejne/kInWnHqoh7tmg68

[@sayedimran5972]

Hi, thank you for this video, in the latest version of keycloak, the upload file feature is not there, instead there are multiple tabs to configure, can you please upload a updated video with the latest keycloak,

[@hexadefence]

Thanks for the request

[@Anonymous5448]

Would be cool to see that video asap - same issue for me

[@hexadefence]

Will upload an updated one most probably next week

[@Anonymous5448]

@@hexadefence if possible, please use both protocols, or separate videos for each protocol too :)

[@hexadefence]

sure@@Anonymous5448

[@parvathynsp]

If I am editting my SP or IDP what should I do?

[@hexadefence]

Hi Parvathy, Could you be more specific and provide more details about the question. Thanks

[@parvathynsp]

@@hexadefence I am trying to integrate ping as an external IDP to keycloak. I am getting some errors probably due to some configuration missmatches. So If I am editting the client in idp should I update anything other than the imported metadata?

[@hexadefence]

What is the error you are getting now? Also is it getting from keycloak or ping?

[@navinaveen5251]

It was showing me like client signature was failed

[@akhlaquealam3205]

How we can run two server in single Keycloak?

[@hexadefence]

Hi, I am using docker to run multiple keycloak instances at once. That is the easiest way. Thanks

[@jeremysweetman6532]

if you're not using docker, I think you can have two copies of keycloak in two different folders. and when you start one of them up you can offset all the ports with the following parameter: $KEYCLOAK_HOME/bin/standalone.sh -Djboss.socket.binding.port-offset=100

[@nareshreddygondewar3885]

can someone suggest how to create two servers like 8080 &9090

[@hexadefence]

You can set - - http-port flag (check http section here www.keycloak.org/server/all-config) Otherwise you can use multiple docker containers.

[@os2baba]

A completely different app other than Keycloak should have been used as the service provider. This is far too confusing since both the IdP and the SP are different deployments of the same app.

[@hexadefence]

Thanks for the suggestion.

[@user-vi1vm7ze3p]

@hexaDefence I tried the SAML as you have specified but when i used IDP initiated login from IDP Keycloak instance to log in into SP Keycloak I got the error "An internal server error has occurred" on page BASE_URL/auth/realms/REALM_NAME/broker/saml/endpoint

[@hexadefence]

Did you check the console logs for the error?