<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Btv. I noticed that you have "First
login flow" set to "registration" and post-login flow set to
"direct grant" . I am quite sure that it is not correct to setup
like this. Value for "First login flow" is usually ok to keep
default value "First broker login" and PostBrokerLogin is usually
ok to be kept empty (unless you want some additional verifications
triggered once user authenticates through your identityProvider,
for example authenticate those users through OTP on keycloak
side). <br>
<br>
See docs for more details:<br>
<a class="moz-txt-link-freetext" href="http://keycloak.github.io/docs/userguide/keycloak-server/html/identity-broker.html#d4e1672">http://keycloak.github.io/docs/userguide/keycloak-server/html/identity-broker.html#d4e1672</a><br>
<a class="moz-txt-link-freetext" href="http://keycloak.github.io/docs/userguide/keycloak-server/html/identity-broker.html#identity-broker-first-login">http://keycloak.github.io/docs/userguide/keycloak-server/html/identity-broker.html#identity-broker-first-login</a><br>
<br>
Marek<br>
<br>
On 03/06/16 09:03, Marek Posolda wrote:<br>
</div>
<blockquote cite="mid:57512BBA.6090607@redhat.com" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<div class="moz-cite-prefix">Am I understand correctly that your
application wants to talk with Keycloak through SAML protocol?
If yes, then SAML Identity provider is not something for your
usecase. SAML Identity provider is useful for the opposite case
(for example: your application wants to talk OIDC with Keycloak,
and Keycloak itself will then use SAML Identity provider to
redirect to some other 3rd party SAML IDP. So defacto Keycloak
acts as "bridge" between OIDC App and external SAML IDP in that
case).<br>
<br>
For your case, you may need regular SAML adapters. Take a look
at keycloak-examples under directory "saml" and at the docs
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://keycloak.github.io/docs/userguide/saml-client-adapter/html/index.html">http://keycloak.github.io/docs/userguide/saml-client-adapter/html/index.html</a><br>
<br>
If your "consumer" application wants to use SAML and you want
Keycloak to use SAML and act as "bridge" then you may need both
SAML adapter and SAML Identity provider.<br>
<br>
Marek<br>
<br>
On 01/06/16 17:08, Marque Davis wrote:<br>
</div>
<blockquote
cite="mid:F1E596E6-84F8-4385-9FB7-7E3ABD49DD4A@premisehealth.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div>Hi,</div>
<div><br>
</div>
<div>I’m working on moving SAML auth in one app into Keycloak.
Since we have many clients hitting our existing API, we don’t
want to change the external API. Instead we need to proxy
through to Keycloak. I have a SAML test harness that generates
the SAML doc and redirects to KC, but I constantly get a
staleCodeError int he logs and the following error on the page
it redirects to.</div>
<div><br>
</div>
<div>WE'RE SORRY ...</div>
<div>This page is no longer valid, please go back to your
application and login again</div>
<div><br>
</div>
<div>I’ve setup an Identity Provider named “saml” and pointed my
test app to the Redirect URI (<a moz-do-not-send="true"
href="http://192.168.99.100:10080/auth/realms/demo/broker/saml/endpoint">http://192.168.99.100:10080/auth/realms/demo/broker/saml/endpoint</a>).
Config screenshot attached (if it isn’t stripped from email)</div>
<div><br>
</div>
<div>Am I doing something wrong, or is this just not a use case
Keycloak is designed for?</div>
<div><br>
</div>
<div><br>
</div>
<div><img src="cid:part3.08070306.06030400@redhat.com"
type="image/png" height="950.000000" width="1186.000000"></div>
<div> </div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</blockquote>
<br>
</body>
</html>