I own an application which has it's own IDP - let's call it app1.
I would like to establish SSO to app2 which uses Keycloak as IDP - let' call it app2.
App1:
Up and running, So I cannot convert my IDP to Keycloak
App2:
No users yet
External vendor app (not managed on my domain)
Which possibilities do I have to establish SSO between app1 and app2?
Thanks
One possible scenario:
You could configure app1-IDP as a third-party IDP in your Keycloak. Then set the app1-IDP as the Default Identity Provider in the Identity Provider Redirector Authenticator in your Realms Browser Flow.
If app-IDP should control the SSO session alone, you can then remove the Cookie Authenticator from the Browser Flow.
Related
Does SSO between OIDC and SAML2 clients are possible in Keycloak? if so how to achieve this condition, either by IDP initiated or SP initiated authentication process.
Does Keycloak produce cookies that can be used in SAML SP clients, even though we authenticate with OIDC clients?
I'm trying to connect my OIDC clients such as VueJS and Spring Boot applications with SAP ECC EHP7, so that I can use the authenticated user either token or cookie to send request SAP ECC EHP7 API.
I have already configure SAP ECC EHP7 SAML2 configuration to add Keycloak as a trusted identity provider and import it as a SP in Keycloak clients.
I need a clear infrastructure and technical configuration of authentication flow and request on how we can achieve this
I have one SP and one IDP using Keycloak.
I'm using SAML protocol and I can successfully login and logout when the request is initiated by the SP.
But when connected as an admin in Keycloak I logout an user from his session no request are sent to the SP.
The session is indeed terminated on the IDP side but not on the SP side.
Because of that the user on the SP can still use the application.
I can't see any option in client configuration for that.
Has anyone made IDP initiated log out in SAML works with keycloak ?
Could you give me some directions ?
Thank you for your time.
After some other research this is not a feature of Keycloak.
https://www.keycloak.org/docs/2.5/server_admin/topics/sessions/administering.html
Quoting the docs
Only certain clients are notified of this logout event, specifically clients that are using the Keycloak OIDC client adapter. Other client types (i.e. SAML) will not receive a backchannel logout request.
I had the same issues using keycloak saml broker. It turned out that enabling back-channel logout (disabling front-channel logout) in keycloak client configuration solved my problem.
I am using 4.8.0.Final
I have an identity provider that connects to a service provider. Im trying to put Okta in the middle of the IDP and the service provider (so that Okta acts as an SP).
I got Okta to work directly with the SP. (I also got the IDP to work directly with the SP.) I'm having an issue getting the IDP to work with Okta in the middle.
Does the IDP's certificate go somewhere in Okta in this case? Does the SP need any information about the IDP?
Is it possible that I have admin access but couldnt find the add identity provider option in Okta?
Would be curious to know what your use case is.
If you put Okta in the middle - then Okta is part SP (to your IDP) and part IDP (to your ultimate SP).
For the part where Okta is SP - you can leverage the instructions here - https://support.okta.com/help/articles/Knowledge_Article/40561903-Configuring-Inbound-SAML to set up an inbound SAML endpoint.
For the second part - to integrate Okta to your SP, you can use the instructions here to set up a SAML app via our App Wizard - https://support.okta.com/help/articles/Knowledge_Article/Using-the-App-Integration-Wizard
If your SP happens to be in our app catalogue, then you can simply do "add application" under the Application tab in the admin console and follow the instructions there to set up SAML with the app.
I have two cross domain apps as service providers. These applications are with IdP (OpenAM) in federation trust. FSSO acomplishes over passive federation, SAML 2.0 protocol, Web Browser SSO Profile. This works fine.
What I have now as an issue is active federation as I see.
Use case :
Sign on App1 over IdP (web browser profile).
Invoke from App1 , App2's web service (SOAP) and send
something
App2 web service should process incoming request without authentication (as these two apps are in federation trust)
As I understand, it should be used SOAP binding most probably in combination with artifact or I am looking wrong ?
What will be the use case ?
Should I send from app1 within SOAP - SAML message completely ?
Or to send to App2 service artifact id and then service will resolve artifact from IdP ?
We are building a SaaS application (enterprise oriented).
We have to be able to log-in the users against the saml2 IdP of their company with SSO functionality (so multi-tenant context)
We prefer to manage it in a isolated component and so not directly on the application it self.
We think to use a kind of "proxy".
We have two questions :
- Does WSO2 IS is able to act as proxy, delegating the authentication to an extern IdP ?
- Our SaaS application will be offered via UI relying on REST ful services, so we need to manage SSO
also with the services, so for example :
. The user comes on the UI without any log-in before
. The company IDP login-page is shown for authentication
. Once logged , the UI will perform some calls to REST service and we need to secure those service call, to be sure
the user is allowed to call this service
How to manage it ?
Does the "proxy" API can act also as "proxy services" in order to call the extern IDP API ?
Tks
Nicolas.
If i got your question correctly, There is an existing IDP in "foo" company. In "bar" domain you have applications. You are not going to integrate application directly with IDP in "foo". And you are wishing to install an another IDP in "bar" domain where this "bar" domain IDP can talks to existing IDP in "foo" domain. Yes. WSO2IS can be used to implement such use case. It has "Authentication Framework" for SAML2 SSO logon... Let me explain it bit. When user is directed to WSO2IS SAML2 IDP, user can be authenticated by verifying user/password which is the default behavior. (default authenticator that is picked by "Authentication Framework"). But there can be any other authenticators such as SAML2 SSO (where WSO2IS can call to another SAML2 IDP and authenticate the user), OpenID and so on. I guess, same scenario has been discussed here. I found blog on implementing this.