<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yiv1742660908"><div id="yui_3_16_0_ym19_1_1467465120417_12140"><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;" id="yui_3_16_0_ym19_1_1467465120417_12139"><div id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3304"><span><br clear="none"></span></div><div id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3304"><span id="yui_3_16_0_ym19_1_1467465120417_12182">After a bit of digging through the keycloak archives, I believe I've found</span></div><div id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3304">an answer to my own question. There is indeed a way to set up identity</div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3304">brokering in keycloak with Salesforce, although the process</div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3304"><span id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3515">is not as straightforward as one would expect. To get the values for </span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3304">ACS URL and Entity Id one should create a SAML 2.0 external IdP,</div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3304">and then "Export" the IdP using the "Export" button. </div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3304"><span><br clear="none"></span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3304"><span id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3638">--Peter </span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467465120417_13418"><br><br></div><div class="yiv1742660908yqt0998249868" id="yiv1742660908yqtfd55654"><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3304"><br clear="none"></div><div class="yiv1742660908qtdSeparateBR" id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3305">>Hello,<br clear="none"></div></div></div></div></div><div class=".yiv1742660908yahoo_quoted" id="yui_3_16_0_ym19_1_1467465120417_13419"><div id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3278" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"><div id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3277" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"><div class="yiv1742660908y_msg_container" id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3276"><div id="yiv1742660908"><div id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3275"><div id="yiv1742660908yui_3_16_0_ym19_1_1467463702306_3274" style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897"><br clear="none"></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>I am trying to integrate keycloak and Salesforce using Salesforce </div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>as an identity provider. It seems some of the information required to </div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>properly set up the Salesforce as SAML IdP is missing in the keycloak's SAML </div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>identity provider configuration. For example, "Entity Id", according to the </div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>Salesforce documentation: </div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>"<span id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_3227" style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;">This value comes from the service provider. </span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897"><span style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;" id="yui_3_16_0_ym19_1_1467465120417_13424">>Each entity ID in an organization must be unique. If you’re accessing multiple </span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897"><span style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;">>apps from your service provider, you only need to define the service provider </span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897"><span style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;">>>once, and then use the </span><samp id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_3228" style="font-size:16.0974px;line-height:17.5608px;">RelayState</samp><span id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_3229" style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;"> parameter to append the URL values </span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897"><span style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;">>to direct the user to the correct app after signing in." (https://help.salesforce.com/HTViewHelpDoc?>id=service_provider_define.htm&language=en_US). </span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897"><span style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;">>The SAML identity provider configuration in keycloak does not have </span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897"><span style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;">>a setting to specify "Entity Id". Another missing attribute is "ACS URL"</span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897"><span style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;"> >(</span><span id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_3347" style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;">The ACS, or assertion consumer service, URL comes from the SAML </span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897"><span style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;">>service provider.). </span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897"><span style="color:rgb(85, 85, 85);font-size:14.634px;line-height:17.5608px;"><br clear="none"></span></div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>Has anyone been able to set up Salesforce as IdP and keycloak </div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>as SP using keycloak's SAML identity provider? Is this even possible </div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>given that some required parameters are missing?</div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>Thx</div><div dir="ltr" id="yiv1742660908yui_3_16_0_ym19_1_1467245447748_2897">>Peter</div></div></div></div><br clear="none"><br clear="none"></div> </div> </div> </div></div></body></html>