What I want to do is this:
I have keycloak integrated with my application. So when my app is launched , keycloak login page is shown to user. Now , I am trying to provide an option to login with PingFedrate. So a button to login with PingFed appears(once a new SAML provider is configured in keycloak). On PingFedrate I tried to integrate SP inititated SSO:
I added a new SP connection and there I configured it as SSP initiated SSO. (It forced me to configure SOAP Authentication , where I selected basic and configured random username password). Then I downloaded metatdata.xml from this SP and imported in keycloak which autofilled the login url as : https://myserver:9031/idp/SSO.saml2 (i.e. without client id). After this when user clickon Login with PingFed - PingFed gives following error:
Unexpected System Error Sorry for the inconvenience. Please contact
your administrator for assistance and provide the reference number
below to help locate and correct the problem.
I found the solution to this.
Firstly, we need to add SP inititated SSO in Pingfed for keycloak.
Secondly, the reason I could not make SP inititated SSO work was that keycloak's entityId should be same as Pingfed SP connection's Partner's Entity Id / Connection Id.
Keycloak, by default keeps entity id equal to url of keyloak server containing your realm. E.g
https://(keycloak-server)/auth/realms/(realm-name)
(and I could not find a way to change it through Keycloak UI)
You need to enter this URL in Pingfed.
To avoid adding this manually, you can download the keycloak config from download export tab of identity provider.
And on Pingfed , import this file.
On a side note, though I was importing it earlier, I was changing value of Partenr id to some other name as I was not aware of above restriction until I started decoding the SAML tokens in request.
Related
I am trying to set up SSO between two Keycloaks. The target Keycloak, where I want to configure the SSO has user federation set up in place and the user management is disabled. I was thinking of configuring IdP brokering between my source Keycloak and the target Keycloak so that I can use the same authentication token.
I have configured login redirection and when I try to login to the target system, I was promptly redirected to the source Keycloak. Unfortunately, upon entering the username and password, I was presented with a dialog box stating that my user already exists and offering me to either Review the profile or Add to existing profile.
Initially, I thought it is because the user modification is disabled by the user federation. I have manually created the same username on the system, which is providing a list of the users but even with this in place, I am still unable to log in and am presented with exactly the same error message.
While trying to achieve pure Keycloak IDP initiated sso to achieve this flow
"Login to keycloak realm ==> Go to applications ==> click on application name and application launches because you are already logged in to the keycloak IDP),
I faced several issues while trying to achieve the above flow, so I gave that up, and now trying to achieve Keycloak brokered sso:
(Browse to the specific Keycloak broker URL ==> Get redirected to the login page of the Keycloak IDP ==> this does a POST of Saml assertion to my application URL ==> Application launches because the user is already logged in / authenticated with IDP).
I am using one instance of Keycloak as IDentity provider (keycloak3) and another instance as Service Provider (keycloak4).
I am following the steps from this existing thread.
idp initiated sso using keycloak
########## Start Steps followed ##########
a. create a saml client at keycloak3 (http://localhost:8083) under realm3. With IdP initiated SSO Name set as some name without spaces) --> say, sso.
b. In the Fine Grain SAML Endpoint Configuration section of the above client, for Assertion Consumer Service (ASC) POST Binding URL --> http://localhost:8084/realms/realm4/broker/saml/endpoint/clients/keycloak4samlclient ( https://www.keycloak.org/docs/latest/server_admin/index.html#idp-initiated-login)
c. click on above created saml client --> installation --> Export SAML Metadata IDPSSODescriptor and save as saml-metadata.xml ( say ).
d. Add a user in keycloak3, say user3/user#456
e. At the keycloak4(http://localhost:8084), create a IDP ( identity providers tab with name saml (refer ASC url). Import the above exported saml-metadata.xml and save.
f. At the keycloak4, create a saml client and in the IDP initiated SSO url give name as keycloak4samlclient
g. In the browser hit, http://localhost:8083/realms/realm3/protocol/saml/clients/sso
Prompt for username/pwd, give credentials for user3
########## End Steps followed ##########
My application is the 'java-saml' application deployed on local tomcat at 8080.
https://github.com/SAML-Toolkits/java-saml/tree/master/samples/java-saml-tookit-jspsample
After I complete all the steps, and browse this URL
http://localhost:8083/realms/realm3/protocol/saml/clients/sso
I am getting "client not found" error. I spent the entire day troubleshooting this one, could not find any leads. Can someone please let me know if you have faced this, and whether you have any solution I can try? This is the screenshot of error.
Error Message: Client not found
I am getting an error when I try to login to Keycloak by using it as a broker.1 I am using credentials from another keycloak instance to login. So far, I am redirected to the correct login page but after entering my credentials I receive an error.
I have set up Keycloack Identity Brokering on computer 1 by following the basic steps.2 I have used the generated redirection URI of the broker to register a new client on computer 2 in another Keycloak instance.3 The client configuration present on computer 2 4 is then used to fill in Authorization URL, Token URL, Client ID and Client Secret on the Identity Broker on Computer 1. 5
I may be leaving important fields missing. Pictures are attached for reference.
I have changed some settings to get the broker to work with the other Keycloak instance. I am now sending client secret as basic auth with signed verification off. I have also enabled back-channel logout. Hope this helps someone else.
I fixed this problem by regenerating the client secret on the identity provider side and using it on keycloak. The keycloak realm data import was not working very well for me apparently.
In my case I needed to empty the hosted domain field in the "Identity providers" configuration of my Google identity provider in Keycloak.
See also:
Keycloak Google identity provider error: "Identity token does not contain hosted domain parameter"
Scenario:
1) Browser(User) requests resource from Service Provider (SP).
2) SP Redirects (with SAML Request) to Identity Provider (IdP).
3) Since it is first login, User gives the (IdP) his/her valid credentials.
4) IdP then redirects Browser (with SAML Response which includes SAML token) to the SP page.
After creation of user, If I try to authenticate it works as expected
but when I change user data on idp, and try after cleaning complete
browser data in any of browser (firefox, chrome) it shows only old
assertion data in SAML response on the way to idp to sp.
Even I have deleted user on idp and created again with same email id
with different user data it shows only old user data in SAML response.
There is nothing exist on browser side even cleaned cached data ,
cookies, and re-installed browser too.
I have gone through : Are SAML tokens cache/stored anywhere on the browser?
Not helped.
I there any settings on idp (OpenAM) side to resolve it? (I have unchecked Disable Federation persistence if NameID Format is unspecified:)
idp: OpenAM-12.0.0, sp: redmine SAML ominiauth
So what I miss here, I don't get it.
I got a solution by exploring the stuff at OpenAM side.
There is no issue with SAML plugin. It is OpenAM which cached SAML assertion attributes so every time it takes old assertion with SAML response.
To resolve issue need to follow below steps in OpenAM:
1) Select Federation-Select SP (from entity provider list)-Assertion content
-Check "Disable Federation persistence if NameID Format is unspecified:"
2) If above case won't work then follow this process:
-Select configuration-Servers and Sites-Default Server Settings:
-Add following properties:
-com.sun.identity.idm.cache.entry.expire.enabled=true
-com.sun.identity.idm.cache.entry.user.expire.time=10
-com.sun.identity.idm.cache.entry.default.expire.time=10
Hello I am using Nexus OSS, and wanted to simulate SSO, using Remote User Token. Currently the Nexus is configured to LDAP authentication, and is working fine.
As per the instructions found here https://books.sonatype.com/nexus-book/reference/rutauth.html
Basically enabled Remote User Token and added header field Name "REMOTE_USER". This user is ldap and has access.
This instance is behind apache, so from apache, To test this RUT, I can set the header value REMOTE_USER, whoever, I don't see passed in user getting logged nor I see cookie being generated. I even tried firefox rest api client and set header, but with the same results. I can see that HTTP header is being set right.
Am I missing something?
Is there a way to debug that? Appreciate any help.
Thanks
S
RUT handles authentication, but the authenticated user still needs to be authorized to access the web UI. What this means is that you need an LDAP user or group mapping in Nexus which assigns the necessary roles and privileges to the user.
I had a similar issue with Nginx, the header was not set using the correct value.
This can be quite confusing, as the reverse proxy does not complain and simply sends a blank request header to Nexus.
Using Keycloak and Nginx (Lua), instead of a preferred_username field in the IdP response:
-- set headers with user info: this will overwrite any existing headers
-- but also scrub(!) them in case no value is provided in the token
ngx.req.set_header("X-Proxy-REMOTE-USER", res.preferred_username)
I had to use the preferred_username field returned in the response's id_token element:
-- set headers with user info: this will overwrite any existing headers
-- but also scrub(!) them in case no value is provided in the token
ngx.req.set_header("X-Proxy-REMOTE-USER", res.id_token.preferred_username)