[keycloak-user] Is An IDP - Initiated SSO to Broker Possible?

[Bill Burke]

So, you:

1. visit the IDP-initiated SSO URL on keycloak

2. Select an external IDP to login from on the Keycloak login page

3. Login to the external IDP

4. Failure?

Sounds like a bug.

If you're trying to do IDP-initiated SSO starting from the external IDP, 
that's not something we support.


On 11/11/16 11:13 PM, Josh Cain wrote:
> Hi all,
>
> I'm attempting an IDP-initiated SSO (via unsolicited SAML Request)
> against the Keycloak broker service.  However, it's failing every time
> on the IdentityBrokerService.authenticated(..) method.  I get the
> following error on the console:
>
> 22:05:04,945 ERROR [org.keycloak.services] (default task-61)
> staleCodeMessage
>
> This method seems to think that clients should *always* visit the
> Keycloak IDP before returning with a SAML assertion, a the failure to
> retrieve an associated client session is causing a serious issue.  I am
> able to successfully use the identity brokering functions if I use an
> SP-initiated flow, so I know the brokering piece is configured
> correctly.
>
> Is this a limitation in the current implementation, or do I have
> something configured incorrectly?
>